IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-10-17 19:15

MODIFIED

2025-10-17 19:15

EPSS (Prob. Exploit)

0.38%

Top 69.3%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

ThingsBoard versions < 4.2.1 contain a stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload an SVG file containing malicious JavaScript, which may be executed when the file is rendered in the UI. This issue results from insufficient sanitization and improper content-type validation of uploaded SVG files.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-fpq4-r87v-g246 MODERATE

ThingsBoard vulnerable to stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature

AFFECTED PACKAGES:

MAVEN / org.thingsboard:application

< 4.2.1

Fixed in: 4.2.1

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Stored Cross-Site Scripting (XSS) in ThingsBoard

AFFECTED PACKAGES:

Unknown / Unknown

9 versions affected

ALIASES:

GHSA-fpq4-r87v-g246

> HISTORIQUE DES MODIFICATIONS

Première apparition

17/10/2025 19:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:08

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui