PT-2025-26781 · Komga · Komga

Paul-Gerste-Sonarsource · Published 2025-06-24 · Updated 2025-06-25 · CVE-2025-52880

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Komga versions 1.8.0 through 1.21.3

Description: A Cross-Site Scripting (XSS) issue has been found in Komga when serving EPUB resources. This allows an attacker to perform actions on the victim's behalf. If an admin user is targeted, it can be combined with server-side command control to achieve arbitrary code execution. The issue requires a malicious EPUB file to be present in a Komga library and accessed by an admin user in the Epub reader.

Recommendations: For versions 1.8.0 through 1.21.3, update to version 1.22.0 to resolve the issue. As a temporary workaround, consider restricting access to the EPUB reader for admin users until the update is applied. Avoid accessing malicious EPUB files in the Epub reader to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-799

Related Identifiers

CVE-2025-52880

GHSA-M7MM-6JXP-2M4X

Affected Products

Komga

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52880.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-52880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52880 · Security Note
• https://github.com/gotson/komga/security/advisories/GHSA-m7mm-6jxp-2m4x · Note
• https://github.com/gotson/komga/commit/5f9cc449b7846ed2066752c72c9ce7b20c3a85a7 · Note
• https://t.me/cvetracker/26976 · Telegram Post
• https://twitter.com/CVEnew/status/1937606225581011425 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1937637109713588446 · Twitter Post