CVE-2025-49590CWE-692

CryptPad Dom-Based Cross-Site Scripting (XSS) Vulnerability

Low · published June 18, 2025

CVSS v4.0
2.9
EPSS
0%
Percentile
24.8
In the wild
Unconfirmed
What it is

CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an "early allow" code path that happens before the URI's protocol/scheme is checked, which a maliciously crafted URI can follow. This issue has been patched in version 2025.3.0.

The record
Technical detail
CVSS v4.0
2.9 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P
EPSS
0.00329 · 24.8th percentile
Weakness
CWE-692 · Incomplete Denylist to Cross-Site Scripting
Published
2025-06-18T22:14Z
EPSS history
Timeline
  • 18 JUN 22:14Z
    CryptPad Dom-Based Cross-Site Scripting (XSS) Vulnerability
    cvelistv5