CVE-2025-3261: Stored Cross-Site Scripting (XSS) in ThingsBoard
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Other sources
ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting (XSS) vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if the malicious images are embedded in an iframe element, during a widget creation, deployed to any page of the platform (e.g., dashboards), and accessed during normal operations. The vulnerability resides in the ImageController, which fails to restrict the execution of JavaScript code when an image is loaded by the user's browser. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3261?
The severity of CVE-2025-3261 is considered significant due to its potential for Stored Cross-Site Scripting vulnerabilities that can affect users.
How do I fix CVE-2025-3261?
To fix CVE-2025-3261, update ThingsBoard to version 4.2.1 or later.
Who is affected by CVE-2025-3261?
CVE-2025-3261 affects authenticated users of ThingsBoard versions prior to 4.2.1.
What type of vulnerability is CVE-2025-3261?
CVE-2025-3261 is categorized as a Stored Cross-Site Scripting (XSS) vulnerability.
What can attackers do with CVE-2025-3261?
Attackers can exploit CVE-2025-3261 to upload malicious SVG images, potentially impacting users accessing the affected API endpoint.