CVE-2025-24372

CVE-2025-24372 affects CKAN when a registered user uploads a specially crafted file, enabling execution of code that can trigger arbitrary server requests and potentially escalate privileges for the submitter or others. The issue is tied to user-upload handling and can be exploited if upload rest...

CVE-2025-24372 XSS vector in user uploaded images in group/org and user profiles in ckan

CKAN is an open-source DMS data management system for powering data hubs and data portals. Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could...