PT-2026-8239 · Arangodb · Arangodb Community Edition

Ozer Goker · Published 2026-02-15 · Updated 2026-02-15 · CVE-2019-25367

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ArangoDB Community Edition version 3.4.2-1

Description The ArangoDB Community Edition contains multiple cross-site scripting issues within the Aardvark web admin interface, specifically in the ‘index.html’ file. These issues are present in search functionality, user management features, and through various API parameters. An attacker can inject scripts via parameters in the / db/ system/ admin/aardvark/index.html endpoint, leading to the execution of JavaScript code within the browsers of authenticated users.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider carefully validating and sanitizing all user inputs to the / db/ system/ admin/aardvark/index.html endpoint. Restrict access to the Aardvark web admin interface to trusted users only.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25367

Affected Products

Arangodb Community Edition

References · 6

• 🔥 https://exploit-db.com/exploits/46407 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25367 · Security Note
• https://vulncheck.com/advisories/arangodb-community-edition-xss-via-aardvark-admin · Note
• https://t.me/CVEtracker/44761 · Telegram Post
• https://t.me/cveNotify/152060 · Telegram Post
• https://arangodb.com · Note