CVE-2025-34281 json
Stored Cross-Site Scripting (XSS) in ThingsBoard
published 2025-10-17 12 mo ago modified 2026-10-19 20 d ago also GHSA-fpq4-r87v-g246 , EUVD-2025-34907
- cvss
- 5.4
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 33%
- public exploits
- 0
- none known
Summary
ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting (XSS) vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if the malicious images are embedded in an `iframe` element, during a widget creation, deployed to any page of the platform (e.g., dashboards), and accessed during normal operations. The vulnerability resides in the `ImageController`, which fails to restrict the execution of JavaScript code when an image is loaded by the user's browser. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.
Patch / fix
- maven org.thingsboard:application 4.2.1
- thingsboard thingsboard 4.2.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 12 mo ago
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N |
| CNA | 4.0 | 6.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.thingsboard:application | <4.2.1 |
4.2.1 |
Affected products
- thingsboard thingsboard
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/thingsboard/thingsboard/commit/b2ae6f92d12206ea185a2e882945a6b69234bf03
patch, web
-
github.com
/thingsboard/thingsboard/pull/13927
web
-
advisory.checkmarx.net
/advisory/CVE-2025-34281/
third-party-advisory
-
github.com
/thingsboard/thingsboard/releases/tag/v4.2.1
release-notes, web
-
nvd.nist.gov
/vuln/detail/CVE-2025-34281
advisory
-
advisory.checkmarx.net
/advisory/CVE-2025-3261
web
-
advisory.checkmarx.net
/advisory/CVE-2025-34281
web
-
github.com
/thingsboard/thingsboard
package
-
vulncheck.com
/advisories/thingsboard-svg-image-stored-xss
web
Sources
- CVE List CVE-2025-34281
- GitHub Advisory GHSA-fpq4-r87v-g246
- NVD CVE-2025-34281
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.