CVE-2025-62793CWE-79cross-site-scripting

CVE-2025-62793

Medium · published October 28, 2025

CVSS v3.1
6.8
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

eLabFTW is an open source electronic lab notebook for research labs. The application served uploaded SVG files inline. Because SVG supports active content, an attacker could upload a crafted SVG that executes script when viewed, resulting in stored XSS under the application origin. A victim who opens the SVG URL or any page embedding it could have their session hijacked, data exfiltrated, or actions performed on their behalf. This vulnerability is fixed n 5.3.0.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00263 · 17.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-28T02:15Z
References (2)
https://github.com/elabftw/elabftw/commit/09b95e38f82f041edac0dd6962c70499e2d8d8e2 · [email protected]https://github.com/elabftw/elabftw/security/advisories/GHSA-rq98-8jh9-684f · [email protected]
EPSS history
Timeline
  • 27 OCT 21:25Z
    eLabFTW HTML / CSS Injection via Malicious SVG Upload Leads to Credential Theft / Clickjacking
    cvelistv5