CVE-2025-41085CWE-79

Stored Cross-Site Scripting (XSS) in Apidog web platform

Medium · published February 4, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
19.7
In the wild
Unconfirmed
What it is

Stored Cross-Site Scripting (XSS) vulnerability type in Apidog in the version 2.7.15, where SVG image uploads are not properly sanitized. This allows attackers to embed malicious scripts in SVG files by sending a POST request to '/api/v1/user-avatar', which are then stored on the server and executed in the context of any user accessing the compromised resource.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00283 · 19.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-02-04T09:56Z
EPSS history
Timeline
  • 04 FEB 09:56Z
    Stored Cross-Site Scripting (XSS) in Apidog web platform
    cvelistv5