CVE-2025-52880 — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2025-52880

CVSS 4.2 · Medium EPSS 0,32%

Kerentanan Improper Control of Interaction Frequency. Skor CVSS 3.1 4.2 (Medium) menurut github.com.

Deskripsi (NVD)

Komga is a media server for comics, mangas, BDs, magazines and eBooks. A Cross-Site Scripting (XSS) vulnerability has been discovered in versions 1.8.0 through 1.21.3 when serving EPUB resources, either directly from the API, or when reading using the epub reader. The vulnerability lets an attacker perform actions on the victim's behalf. When targeting an admin user, this can be combined with controlling a server-side command to achieve arbitrary code execution. For this vulnerability to be exploited, a malicious EPUB file has to be present in a Komga library, and subsequently accessed in the Epub reader by an admin user. Version 1.22.0 contains a patch for the issue.

Rincian

Terbit di NVD: 24 Juni 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Deferred
CVSS 3.1: 4.2 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-799: Improper Control of Interaction Frequency
EPSS (30 hari): 0,32% peluang dieksploitasi; lebih tinggi dari 23,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.