GHSA-5P82-2Q3R-WJ3M ThingsBoard allows an authenticated user to upload malicious SVG images

ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting XSS vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if t...

CVE-2025-3261

ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting XSS vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if t...

CVE-2025-3261

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2025-3261

...

CVE-2025-3261

...

CVE-2025-3261

CVE-2025-3261 entry is rejected/not used as stated; it does not represent an active vulnerability.

编号撤回

ThingsBoard is a Java-based platform for IOT devices for monitoring, management, and data collection by the ThingsBoard team. A security vulnerability exists in ThingsBoard versions prior to 4.2.1, which stems from Image Gallery allowing the uploading of malicious SVG images, which could lead to ...

GHSA-HGRR-935X-PQ79 vulnerabilities

Vulnerabilities for packages: thingsboard...

CVE-2025-61795 vulnerabilities

Vulnerabilities for packages: thingsboard...

CVE-2025-11226 vulnerabilities

Vulnerabilities for packages: dependency-track, keycloak-config-cli, thingsboard, trino, management-api-for-apache-cassandra-5.0, nextflow, cassandra-reaper, zookeeper, kserve-modelmesh, apache-nifi, apache-nifi-registry, sonar-scanner-cli, cassandra, akhq...

GHSA-25QH-J22F-PWP8 vulnerabilities

Vulnerabilities for packages: dependency-track, keycloak-config-cli, thingsboard, trino, management-api-for-apache-cassandra-5.0, nextflow, cassandra-reaper, zookeeper, kserve-modelmesh, apache-nifi, apache-nifi-registry, sonar-scanner-cli, cassandra, akhq...

GHSA-25QH-J22F-PWP8 vulnerabilities

Vulnerabilities for packages: kayenta, thingsboard, nacos, akhq, cassandra-fips, dependency-track, management-api-for-apache-cassandra-4.0, nacos-docker, sonar-scanner-cli, knative-kafka-broker-fips, management-api-for-apache-cassandra-5.0, ontop-fips, apache-nifi-registry, cassandra-reaper,...

CVE-2025-11226 vulnerabilities

Vulnerabilities for packages: kayenta, thingsboard, nacos, akhq, cassandra-fips, dependency-track, management-api-for-apache-cassandra-4.0, nacos-docker, sonar-scanner-cli, knative-kafka-broker-fips, management-api-for-apache-cassandra-5.0, ontop-fips, apache-nifi-registry, cassandra-reaper,...

CVE-2025-34282

ThingsBoard versions 4.2.1 contain a server-side request forgery SSRF vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may...

CVE-2025-34281

ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting XSS vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if t...

CVE-2025-41254 vulnerabilities

Vulnerabilities for packages: thingsboard...

GHSA-7FCH-4F2F-JCGM vulnerabilities

Vulnerabilities for packages: thingsboard...

CVE-2025-41254 vulnerabilities

Vulnerabilities for packages: thingsboard...

GHSA-7FCH-4F2F-JCGM vulnerabilities

Vulnerabilities for packages: thingsboard...

EUVD-2025-34906

ThingsBoard versions 4.2.1 contain a server-side request forgery SSRF vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may...