PT-2025-29525 · Racoon · Dracoon Branding Service

Collfuse · Published 2025-07-14 · Updated 2025-07-29 · CVE-2025-53839

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: DRACOON Branding Service versions prior to 2.10.0

Description: DRACOON is a file sharing service, and the DRACOON Branding Service allows customers to customize their DRACOON interface. Versions prior to 2.10.0 are susceptible to cross-site scripting due to improper neutralization of input from administrative users, potentially allowing HTML code injection into the workflow for new users.

Recommendations: Update to DRACOON Branding Service version 2.10.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-53839

GHSA-JV2H-8MW7-MC97

Affected Products

Dracoon Branding Service

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-53839 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53839 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1944949219703263346 · Twitter Post
• https://t.me/cvetracker/27832 · Telegram Post
• https://twitter.com/CVEnew/status/1944903204212511040 · Twitter Post
• https://t.me/cvenotify/128951 · Telegram Post
• https://github.com/dracoon/security-advisories/security/advisories/GHSA-jv2h-8mw7-mc97 · Note
• https://twitter.com/jmdevlabs/status/1950038193601954269 · Twitter Post