CVE-2025-24372 json
XSS vector in user uploaded images in group/org and user profiles in ckan
published 2025-02-05 21 mo ago modified 2026-07-07 4 mo ago also EUVD-2025-0234 , GHSA-7pq5-qcp6-mcww , PYSEC-2026-1250
- cvss
- 7.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could lead to escalation of privileges of the original submitter or other malicious actions. Users must have been registered to the site to exploit this vulnerability. This vulnerability has been fixed in CKAN 2.10.7 and 2.11.2. Users are advised to upgrade. On versions prior to CKAN 2.10.7 and 2.11.2, site maintainers can restrict the file types supported for uploading using the `ckan.upload.user.mimetypes` / `ckan.upload.user.types` and `ckan.upload.group.mimetypes` / `ckan.upload.group.types` config options. To entirely disable file uploads users can use: `ckan.upload.user.types = none`
Patch / fix
- pypi ckan 2.10.7, 2.11.2
- okfn ckan 2.10.7, 2.11.2
- github.com/ckan/ckan@7da6a26 commit
- github.com/ckan/ckan@a4fc5e0 commit
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
| OSV | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | ckan | <2.10.7 >=2.11.0, <2.11.2 |
2.10.7 2.11.2 |
Affected products
- ckan ckan
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/ckan/ckan/commit/7da6a26c6183e0a97a356d1b1d2407f3ecc7b9c8
web
-
github.com
/ckan/ckan/commit/a4fc5e06634ed51d653ab819a7efc8e62f816f68
web
-
github.com
/ckan/ckan/security/advisories/GHSA-7pq5-qcp6-mcww
web
-
docs.ckan.org
/en/latest/maintaining/configuration.html#ckan-upload-group-mimetypes
web
-
docs.ckan.org
/en/latest/maintaining/configuration.html#ckan-upload-group-types
web
-
docs.ckan.org
/en/latest/maintaining/configuration.html#ckan-upload-user-mimetypes
web
-
docs.ckan.org
/en/latest/maintaining/configuration.html#ckan-upload-user-types
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-24372
advisory
-
github.com
/ckan/ckan
package
-
pypi.org
/project/ckan
package
-
github.com
/advisories/GHSA-7pq5-qcp6-mcww
advisory
Sources
- CVE List CVE-2025-24372
- GitHub Advisory GHSA-7pq5-qcp6-mcww
- NVD CVE-2025-24372
- OSV PYSEC-2026-1250
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.