Phraseanet 4.0.3 Stored XSS via Document Upload

published 2026-02-11 8 mo ago modified 2026-10-08 31 d ago also GHSA-gcpq-mrgg-v5f3 , EUVD-2018-21613

cvss: 6.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits: 0; none known

Phraseanet 4.0.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through crafted file names during document uploads. Attackers can upload files with embedded SVG scripts that execute in the browser, potentially stealing cookies or redirecting users when the file is viewed.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 8 mo ago (2026-02-11)

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

exploit-db.com https://www.exploit-db.com/exploits/46935 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CNA	3.1	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CNA	4.0	5.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub	3.1	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	phraseanet/phraseanet	1 listed version	no fix listed

Affected products

Phraseanet Phraseanet DAM Open Source

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

exploit-db.com /exploits/46935
exploit, web
phraseanet.com
product, web
phraseanet.com /en/download/
product
vulncheck.com /advisories/phraseanet-stored-xss-via-document-upload
third-party-advisory, web
nvd.nist.gov /vuln/detail/CVE-2018-25157
advisory
github.com /alchemy-fr/Phraseanet
package
phraseanet.com /en/download
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary