PT-2025-47414 · Emby · Emby Server

Published 2025-11-18 · Updated 2025-11-19 · CVE-2025-64325

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Emby Server versions prior to 4.8.1.0 Emby Server versions prior to 4.9.0.0-beta

Description Emby Server is a personal media server. A malicious user can send an authentication request with a manipulated X-Emby-Client value. This value is added to the devices section of the admin dashboard without proper sanitization, potentially allowing for malicious actions.

Recommendations Update Emby Server to version 4.8.1.0 or later. Update Emby Server to Beta version 4.9.0.0-beta or later.

Exploit

Fix

RCE

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-116

CWE-79

Related Identifiers

CVE-2025-64325

GHSA-2GWC-988R-2R7X

Affected Products

Emby Server

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64325.json · Exploit
• 🔥 https://github.com/EmbySupport/Emby.Security/security/advisories/GHSA-2gwc-988r-2r7x · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-64325 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64325 · Vendor Advisory
• https://t.me/cveNotify/143294 · Telegram Post
• https://t.me/CVEtracker/37685 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1990969211988881491 · Twitter Post
• https://twitter.com/CVEnew/status/1991042936423825724 · Twitter Post