CVE-2025-71419: UVdesk core-framework before 1.1.7 Stored XSS via SwiftMailer
UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLEAGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
UVdesk core-frameworkto a version that resolves this vulnerability.Fixed in 1.1.7 - Compensating control
If you cannot upgrade immediately, restrict ROLE_AGENT access so only trusted users can reach the configuration update page/API endpoint that contains the SwiftMailer configuration identifier parameter.
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the injected script?
An attacker needs an account with the ROLE_AGENT role to submit a malicious SwiftMailer configuration identifier. The stored script executes when other members access the configuration update page.
Which versions are affected?
UVdesk core-framework versions before 1.1.7 are affected.
How can I determine whether my instance may already be affected?
Review existing SwiftMailer configuration identifiers, particularly those created or modified by ROLE_AGENT users, for unexpected script content. Also review access to the configuration update page, because that is where stored payloads execute.