CVE-2025-64759

Katalog CVE

CVSS 6.1 · Medium EPSS 0,32%

Kerentanan Improper Input Validation pada homarr. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction required, due to the rendering of a malicious uploaded SVG file. This could be abused to add an attacker's account to the "credentials-admin" group, giving them full administrative access, if a user logged in as an administrator was to view the page which renders or redirects to the SVG. This issue has been patched in version 1.43.3.

Rincian

Terbit di NVD

19 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/homarr-labs/homarr/security/advisories/GHSA-wj62-c5gr-2x53 patch · advisory vendor
• https://github.com/homarr-labs/homarr/commit/aaa23f37321be1e110f722b36889b2fd3bea2059 patch · permissions required