PT-2025-42641 · Unknown · Thingsboard

João Oliveira + 1 · Published 2025-10-17 · Updated 2026-02-10 · CVE-2025-34281

Positive Technologies (AI Summary)

CVSS v4.0

6.2

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions ThingsBoard versions prior to 4.2.1

Description The software contains a stored cross-site scripting (XSS) issue within the dashboard's Image Upload Gallery feature. An attacker can upload a Scalable Vector Graphics (SVG) file containing malicious JavaScript. This JavaScript may be executed when the file is rendered in the user interface. The issue is due to inadequate sanitization and improper content-type validation of uploaded SVG files.

Recommendations Update to version 4.2.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-34281

GHSA-FPQ4-R87V-G246

Affected Products

Thingsboard

References · 13

• https://github.com/thingsboard/thingsboard/commit/b2ae6f92d12206ea185a2e882945a6b69234bf03 · Patch
• https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1 · Patch
• https://github.com/thingsboard/thingsboard/pull/13927 · Patch
• https://osv.dev/vulnerability/CVE-2025-34281 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34281 · Security Note
• https://osv.dev/vulnerability/GHSA-fpq4-r87v-g246 · Vendor Advisory
• https://github.com/thingsboard/thingsboard · Note
• https://advisory.checkmarx.net/advisory/CVE-2025-34281 · Note
• https://twitter.com/CVEnew/status/1979289019482521834 · Twitter Post
• https://advisory.checkmarx.net/advisory/CVE-2025-3261 · Note
• https://t.me/cveNotify/151571 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1979312603361943716 · Twitter Post
• https://vulncheck.com/advisories/thingsboard-svg-image-stored-xss · Note