PT-2025-50214 · Allskyteam+1 · Allsky

Published 2025-12-09 · Updated 2025-12-22 · CVE-2025-65572

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AllskyTeam AllSky version 2024.12.06 06

Description A Cross Site Scripting (XSS) issue exists in AllskyTeam AllSky version 2024.12.06 06. This allows remote attackers to execute arbitrary code through the config, filename, or extratext parameters in the 'allskySettings.php' file. The showMessages() function within 'status messages.php' executes injected scripts when the page is reloaded or accessed.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the 'allskySettings.php' file.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-65572

Affected Products

Allsky

References · 7

• 🔥 https://gh0stmezh.wordpress.com/2025/12/04/cve-2025-65572 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65572 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65572 · Vendor Advisory
• https://github.com/AllskyTeam/allsky · Note
• https://github.com/AllskyTeam/allsky/blob/master/html/includes/allskySettings.php · Note
• https://github.com/AllskyTeam/allsky/blob/master/html/includes/status_messages.php · Note
• https://twitter.com/CVEnew/status/2003233993945436598 · Twitter Post