CVE-2025-34282: ThingsBoard < v4.2.1 SVG Image SSRF
ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may initiate unintended outbound requests. This can be used to access internal services or resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ThingsBoardto a version that resolves this vulnerability.Fixed in 4.2.1 - Compensating control
Restrict outbound network access from the ThingsBoard server (e.g., via firewall/egress rules) to prevent SSRF-initiated requests from reaching internal services or external destinations.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34282?
CVE-2025-34282 is classified as a high severity vulnerability due to its potential for server-side request forgery.
How do I fix CVE-2025-34282?
To fix CVE-2025-34282, upgrade ThingsBoard to version 4.2.1 or later.
What component of ThingsBoard is affected by CVE-2025-34282?
CVE-2025-34282 affects the Image Upload Gallery feature of ThingsBoard.
Can CVE-2025-34282 lead to data exposure?
Yes, CVE-2025-34282 can lead to data exposure through malicious SVG file uploads.
Is CVE-2025-34282 a client-side or server-side vulnerability?
CVE-2025-34282 is a server-side vulnerability.