Home > Vulnerability Database > CVE-2025-34281

Mend.io Vulnerability Database

CVE-2025-34281

Good to know:

Date: October 17, 2025

ThingsBoard versions < 4.2.1 contain a stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload an SVG file containing malicious JavaScript, which may be executed when the file is rendered in the UI. This issue results from insufficient sanitization and improper content-type validation of uploaded SVG files.

Severity Score

0.0

Related Resources (5)

Url: https://www.vulncheck.com/advisories/thingsboard-svg-image-stored-xss

Url: https://github.com/thingsboard/thingsboard/pull/13927

Url: https://nvd.nist.gov/vuln/detail/CVE-2025-34281

Url: https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1

Url: https://www.mend.io/vulnerability-database/CVE-2025-34281

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

Top Fix

Upgrade Version

Upgrade to version https://github.com/thingsboard/thingsboard.git - v4.2.1

Learn More

CVSS v3.1

Base Score:	0.0
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	REQUIRED
Scope (S):	CHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	NONE