CVE-2025-55944: XSS

Published Sep 3, 2025

Updated

Slink v1.4.9 allows stored cross-site scripting (XSS) via crafted SVG uploads. When a user views the shared image in a new browser tab, the embedded JavaScript executes. The issue affects both authenticated and unauthenticated users.

Affected Software

4 affected components

Slink Slink

Slinkapp Slink=1.4.9

Slinkapp Slink=1.5.1

Slinkapp Slink=1.6.3

Event History

Sep 3, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Do attackers need an account to exploit this issue?

No. The issue is stated to affect both authenticated and unauthenticated users, so an attacker does not need authentication to be in scope for exploitation.

What user action triggers the malicious script?

The embedded JavaScript executes when someone views the shared SVG image in a new browser tab. The payload is stored in a crafted SVG upload rather than requiring the attacker to interact with the victim at that time.

What impact can successful exploitation have?

The supplied CVSS vector indicates low confidentiality and integrity impact, with no availability impact. Because scope is changed, the script executes in the context reached by viewing the shared image.

Which versions should be investigated?

The description specifically identifies Slink v1.4.9. One supplied reference path is labeled as covering Slink up to 1.6.3, but the provided data does not give a definitive affected-version range.

CVE-2025-55944: XSS

Affected Software

Event History

Frequently Asked Questions

Do attackers need an account to exploit this issue?

What user action triggers the malicious script?

What impact can successful exploitation have?

Which versions should be investigated?

Company

Resources

Contact

Frequently Asked Questions

Do attackers need an account to exploit this issue?

What user action triggers the malicious script?

What impact can successful exploitation have?

Which versions should be investigated?