CVE-2025-34281

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-34281
ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting (XSS) vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if the malicious images are embedded in an `iframe` element, during a widget creation, deployed to any page of the platform (e.g., dashboards), and accessed during normal operations. The vulnerability resides in the `ImageController`, which fails to restrict the execution of JavaScript code when an image is loaded by the user's browser. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://advisory.checkmarx.net/advisory/CVE-2025-3261/
https://github.com/thingsboard/thingsboard/commit/b2ae6f92d12206ea185a2e882945a6b69234bf03
https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1 Release Notes
Configurations

Configuration 1 (hide)

cpe:2.3:a:thingsboard:thingsboard:*:*:*:*:*:*:*:*
History

16 Dec 2025, 11:15

Type Values Removed Values Added
Summary (en) ThingsBoard versions < 4.2.1 contain a stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload an SVG file containing malicious JavaScript, which may be executed when the file is rendered in the UI. This issue results from insufficient sanitization and improper content-type validation of uploaded SVG files. (en) ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting (XSS) vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if the malicious images are embedded in an `iframe` element, during a widget creation, deployed to any page of the platform (e.g., dashboards), and accessed during normal operations. The vulnerability resides in the `ImageController`, which fails to restrict the execution of JavaScript code when an image is loaded by the user's browser. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.
References
  • {'url': 'https://github.com/thingsboard/thingsboard/pull/13927', 'tags': ['Issue Tracking'], 'source': 'disclosure@vulncheck.com'}
  • {'url': 'https://www.vulncheck.com/advisories/thingsboard-svg-image-stored-xss', 'tags': ['Third Party Advisory'], 'source': 'disclosure@vulncheck.com'}
  • () https://advisory.checkmarx.net/advisory/CVE-2025-3261/ -
  • () https://github.com/thingsboard/thingsboard/commit/b2ae6f92d12206ea185a2e882945a6b69234bf03 -
References () https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1 - Release Notes () https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1 - Release Notes

24 Oct 2025, 13:27

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4
First Time Thingsboard
Thingsboard thingsboard
CPE cpe:2.3:a:thingsboard:thingsboard:*:*:*:*:*:*:*:*
References () https://github.com/thingsboard/thingsboard/pull/13927 - () https://github.com/thingsboard/thingsboard/pull/13927 - Issue Tracking
References () https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1 - () https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1 - Release Notes
References () https://www.vulncheck.com/advisories/thingsboard-svg-image-stored-xss - () https://www.vulncheck.com/advisories/thingsboard-svg-image-stored-xss - Third Party Advisory

17 Oct 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-10-17 19:15

Updated : 2025-12-16 11:15

NVD link : CVE-2025-34281

Mitre link : CVE-2025-34281

CVE.ORG link : CVE-2025-34281

JSON object : View

Products Affected

thingsboard

  • thingsboard
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')