PT-2025-26187 · Cryptpad · Cryptpad

Lachlan2K · Published 2025-06-18 · Updated 2025-08-11 · CVE-2025-49590

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions CryptPad versions prior to 2025.3.0

Description The issue concerns the "Link Bouncer" functionality in CryptPad, a collaboration suite, which attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS). However, this filtering can be bypassed due to an "early allow" code path that occurs before the URI's protocol/scheme is checked, allowing a maliciously crafted URI to exploit this weakness.

Recommendations For versions prior to 2025.3.0, update to version 2025.3.0 to resolve the issue. As a temporary workaround, consider restricting the use of the "Link Bouncer" functionality until the update can be applied.

Exploit

Fix

Weakness Enumeration

CWE-692

Related Identifiers

CVE-2025-49590

GHSA-VQ9H-X3GR-V8RJ

Affected Products

Cryptpad

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49590.json · Exploit
• https://github.com/cryptpad/cryptpad/security/advisories/GHSA-vq9h-x3gr-v8rj · Vendor Advisory
• https://github.com/cryptpad/cryptpad/commit/d5e4830ba104a4a442cb23aab5378b8565a95607 · Patch
• https://osv.dev/vulnerability/CVE-2025-49590 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49590 · Security Note
• https://github.com/cryptpad/cryptpad/blob/15c81aa8ccb737a9a1167481f4a699af331364bb/www/bounce/main.js#L64-L95 · Note
• https://t.me/cvenotify/126129 · Telegram Post
• https://twitter.com/CVEnew/status/1935723281858064728 · Twitter Post
• https://t.me/cveNotify/131709 · Telegram Post
• https://t.me/cvetracker/26531 · Telegram Post