CVE-2025-13488CWE-79cross-site-scripting

CVE-2025-13488

published December 5, 2025

CVSS
5.1
EPSS
0%
Percentile
25.0
In the wild
Unconfirmed
What it is

Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories. This may allow an authenticated attacker with repository upload privileges to exploit a stored cross-site scripting (XSS) vulnerability with user context.

The record
Technical detail
CVSS
5.1 · NONE
CVSS v4.0
Not supplied
EPSS
0.00331 · 25.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-12-05T00:16Z
References (2)
https://help.sonatype.com/en/sonatype-nexus-repository-3-87-0-release-notes.html · 103e4ec9-0a87-450b-af77-479448ddef11https://support.sonatype.com/hc/en-us/articles/46896142768019 · 103e4ec9-0a87-450b-af77-479448ddef11
EPSS history
Timeline
  • 04 DEC 18:16Z
    Nexus Repository 3 - Stored Cross-Site Scripting (XSS)
    cvelistv5