PT-2025-51981 · Bookmarkx+1 · Bookmark+1

Deema Alfehaid · Published 2025-12-17 · Updated 2025-12-20 · CVE-2025-14202

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions (affected versions not specified)

Description A flaw exists in the file upload process within the bookmark and asset rendering pipeline. An attacker can upload a malicious SVG file containing JavaScript code. When an authenticated administrator user views this SVG file, the embedded JavaScript executes within their browser. This JavaScript retrieves the Cross-Site Request Forgery (CSRF) token and uses it to send a request to modify the administrator's password, leading to a complete account takeover. The attack targets the bookmark and asset rendering pipeline components.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-14202

Affected Products

Asset Rendering Pipeline

Bookmark

References · 5

• https://cve.org/cverecord?id=CVE-2025-14202 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-14202 · Security Note
• https://twitter.com/CVEnew/status/2002487764810616850 · Twitter Post
• https://t.me/CVEtracker/40106 · Telegram Post
• https://t.me/cveNotify/146140 · Telegram Post