Home > Vulnerability Database > CVE-2025-49590

Mend.io Vulnerability Database

CVE-2025-49590

Good to know:

Date: June 18, 2025

CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an "early allow" code path that happens before the URI's protocol/scheme is checked, which a maliciously crafted URI can follow. This issue has been patched in version 2025.3.0.

Severity Score

0.0

Related Resources (5)

Url: https://nvd.nist.gov/vuln/detail/CVE-2025-49590

Url: https://github.com/cryptpad/cryptpad/security/advisories/GHSA-vq9h-x3gr-v8rj

Url: https://github.com/cryptpad/cryptpad/commit/d5e4830ba104a4a442cb23aab5378b8565a95607

Url: https://github.com/cryptpad/cryptpad/blob/15c81aa8ccb737a9a1167481f4a699af331364bb/www/bounce/main.js#L64-L95

Url: https://www.mend.io/vulnerability-database/CVE-2025-49590

Weakness Type (CWE)

Incomplete Denylist to Cross-Site Scripting

CWE-692

Top Fix

Upgrade Version

Upgrade to version https://github.com/cryptpad/cryptpad.git - 2025.3.0

Learn More

CVSS v3.1

Base Score:	0.0
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	CHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	NONE