PT-2025-44056 · Elabftw · Elabftw

Published 2025-10-27 · Updated 2025-10-28 · CVE-2025-62793

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions eLabFTW versions prior to 5.3.0

Description eLabFTW, an electronic lab notebook, allowed the serving of uploaded SVG files inline. Due to SVG’s support for active content, a malicious SVG file could be uploaded and executed when viewed, leading to stored cross-site scripting (XSS) under the application’s origin. A successful exploit could allow an attacker to hijack a victim’s session, steal data, or perform actions on their behalf. The application serves uploaded SVG files inline.

Recommendations Update to version 5.3.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62793

GHSA-RQ98-8JH9-684F

Affected Products

Elabftw

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62793.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-62793 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62793 · Vendor Advisory
• https://github.com/elabftw/elabftw/commit/09b95e38f82f041edac0dd6962c70499e2d8d8e2 · Note
• https://github.com/elabftw/elabftw/security/advisories/GHSA-rq98-8jh9-684f · Note
• https://t.me/CVEtracker/35908 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1983013365719953451 · Twitter Post