CVE-2025-57292

CVE-2025-57292 affects Todoist v8484, with a stored cross-site scripting (XSS) flaw in the avatar upload feature. The root cause is improper MIME-type validation and insufficient sanitization of image metadata, enabling script execution through uploaded avatars. Public references from multiple so...

CVE-2025-57292

Todoist v8484 contains a stored cross-site scripting XSS vulnerability in the avatar upload functionality. The application fails to properly validate the MIME type and sanitize image metadata...