PT-2025-30307 · Cadwyn+1 · Cadwyn+1

Protozeit · Published 2025-07-21 · Updated 2025-07-23 · CVE-2025-53528

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Cadwyn versions 5.4.3 and below

Description Cadwyn is a production-ready, community-driven, modern Stripe-like API versioning tool in FastAPI. The version parameter of the /docs endpoint is susceptible to a Reflected Cross-Site Scripting (XSS) attack. This allows an attacker to execute JavaScript code on a user's session via a one-click attack. The vulnerable code resides within the swagger dashboard and redoc dashboard functions, specifically utilizing the get swagger ui html function from FastAPI without proper encoding or sanitization of the version parameter. The user-controlled injection occurs within a <script> tag context.

Recommendations Cadwyn versions 5.4.3 and below: Upgrade to version 5.4.4 or later to resolve this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-53528

GHSA-2GXP-6R36-M97R

PYSEC-2025-71

Affected Products

Cadwyn

Fastapi

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53528.json · Exploit
• https://osv.dev/vulnerability/PYSEC-2025-71 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2gxp-6r36-m97r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53528 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53528 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/cadwyn/PYSEC-2025-71.yaml · Note
• https://github.com/zmievsa/cadwyn/blob/5.4.3/CHANGELOG.md#543 · Note
• https://github.com/zmievsa/cadwyn · Note
• https://github.com/zmievsa/cadwyn/security/advisories/GHSA-2gxp-6r36-m97r · Note
• https://github.com/zmievsa/cadwyn/commit/b424ecd57cd8dabbc8fe39b8f8ccafea629c7728 · Note
• https://t.me/cveNotify/129979 · Telegram Post
• https://twitter.com/CVEnew/status/1947397526736323068 · Twitter Post
• https://t.me/cvetracker/28330 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1947486807106486543 · Twitter Post