CVE-2025-7066

Katalog CVE

CVSS 6.1 · Medium EPSS 0,31%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada jirafeau. Skor CVSS 3.1 6.1 (Medium) menurut gitlab.com.

Deskripsi (NVD)

Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scripting. This was done by storing the MIME type of a file and allowing only browser preview for MIME types beginning with image (except for image/svg+xml, see CVE-2022-30110 and CVE-2024-12326), video and audio. However, it was possible to bypass this check by sending a manipulated MIME type containing a comma and an other MIME type like text/html (for example image/png,text/html). Browsers see multiple MIME types and text/html would takes precedence, allowing a possible attacker to do a cross-site scripting attack. The check for MIME types was enhanced to prevent a browser preview when the stored MIME type contains a comma.

Rincian

Terbit di NVD

4 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber gitlab.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.com/jirafeau/Jirafeau/-/commit/79464ec6276e8eb0e0b0ad597db02b85080d2b63 patch
• https://www.cve.org/CVERecord?id=CVE-2022-30110 advisory pihak ketiga
• https://www.cve.org/CVERecord?id=CVE-2024-12326 advisory pihak ketiga