GHSA-fpq4-r87v-g246

ThingsBoard vulnerable to stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-34281

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.thingsboard:application	< 4.2.1	4.2.1

Details

As written in the advisory (Markdown source, shown as plain text).

ThingsBoard versions < 4.2.1 contain a stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload an SVG file containing malicious JavaScript, which may be executed when the file is rendered in the UI. This issue results from insufficient sanitization and improper content-type validation of uploaded SVG files.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-34281 advisory
https://github.com/thingsboard/thingsboard/pull/13927 web
https://github.com/thingsboard/thingsboard/commit/b2ae6f92d12206ea185a2e882945a6b69234bf03 web
https://advisory.checkmarx.net/advisory/CVE-2025-3261 web
https://advisory.checkmarx.net/advisory/CVE-2025-34281 web
https://github.com/thingsboard/thingsboard package
https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1 web
https://www.vulncheck.com/advisories/thingsboard-svg-image-stored-xss web