CVE-2025-71385

🗓️ 02 Jul 2026 19:37:42Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 30 Views🌐 WEB

Netdata before 2.3.1 reflects XSS via love in ilove.svg endpoints, enabling unauthenticated access.

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2025-71385	2 Jul 202619:37	–	attackerkb
AlpineLinux	CVE-2025-71385	2 Jul 202619:37	–	alpinelinux
Circl	CVE-2025-71385	3 Jul 202615:00	–	circl
Cvelist	CVE-2025-71385 Netdata < 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg Endpoint	2 Jul 202619:37	–	cvelist
Debian CVE	CVE-2025-71385	2 Jul 202619:37	–	debiancve
EUVD	EUVD-2025-210409	2 Jul 202619:37	–	euvd
NVD	CVE-2025-71385	2 Jul 202620:17	–	nvd
OSV	DEBIAN-CVE-2025-71385	2 Jul 202620:17	–	osv
OSV	UBUNTU-CVE-2025-71385	2 Jul 202620:17	–	osv
Positive Technologies	PT-2026-55285	2 Jul 202600:00	–	ptsecurity

NVD

Vulners

CNA

Node

netdata netdataRange<2.3.1

[
  {
    "vendor": "netdata",
    "product": "netdata",
    "defaultStatus": "unaffected",
    "packageURL": "pkg:github/netdata/netdata",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "2.3.1",
        "versionType": "semver"
      }
    ],
    "repo": "https://github.com/netdata/netdata"
  }
]

Source	Link
github	www.github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af
vulncheck	www.vulncheck.com/advisories/netdata-reflected-cross-site-scripting-via-love-parameter-in-ilove-svg-endpoint
github	www.github.com/netdata/netdata/releases/tag/v2.3.1
github	www.github.com/netdata/netdata/pull/19919

Parameter	Position	Path	Description	CWE
love	query param	api/v2/ilove.svg	Reflected XSS via unescaped love query parameter in SVG response (Content-Type image/svg+xml)	CWE-79
love	query param	api/v3/ilove.svg	Reflected XSS via unescaped love query parameter in SVG response (Content-Type image/svg+xml)	CWE-79

14 Jul 2026 23:17Current

5.7Medium risk

Vulners AI Score5.7

CVSS 45.1

CVSS 3.16.1

EPSS0.00237

SSVC

CWE-79