CVE-2025-52559

Zulip Server contains an XSS vulnerability in the /digest/ URL that previews weekly digests, affecting topic and channel names. Affected versions are Zulip Server 2.0.0-rc1 through before 10.4. The issue is fixed in Zulip Server 10.4. Workarounds include denying access to /digest/ until updated. ...

CVE-2025-52559: Improper Neutralization of Input During Web Page Generation

Zulip is an open-source team chat application. From versions 2.0.0-rc1 to before 10.4 in Zulip Server, the /digest/ URL of a server shows a preview of what the email weekly digest would contain. This URL, though not the digest itself, contains a cross-site scripting XSS vulnerability in both topi...

PT-2025-27675 · Unknown · Zulip Server

Name of the Vulnerable Software and Affected Versions: Zulip Server versions 2.0.0-rc1 through 10.3 Description: The issue concerns a cross-site scripting XSS vulnerability in Zulip Server, specifically affecting the "/digest/" URL, which displays a preview of the email weekly digest. This...

Zulip server 跨站脚本漏洞

Zulip server is an open source team chat application from Zulip Inc. in the United States. A cross-site scripting vulnerability exists in Zulip server versions 2.0.0-rc1 through prior to 10.4, which stems from a cross-site scripting vulnerability in the /digest/ URL...