CVE-2025-62793

{
  "id": "CVE-2025-62793",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-27T22:15:42.307",
  "lastModified": "2026-10-19T13:10:00.110",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "eLabFTW is an open source electronic lab notebook for research labs. The application served uploaded SVG files inline. Because SVG supports active content, an attacker could upload a crafted SVG that executes script when viewed, resulting in stored XSS under the application origin. A victim who opens the SVG URL or any page embedding it could have their session hijacked, data exfiltrated, or actions performed on their behalf. This vulnerability is fixed n 5.3.0."
    },
    {
      "lang": "es",
      "value": "eLabFTW es un cuaderno de laboratorio electrónico de código abierto para laboratorios de investigación. La aplicación servía los archivos SVG subidos en línea. Dado que SVG admite contenido activo, un atacante podría subir un SVG manipulado que ejecuta un script al ser visualizado, lo que resultaría en XSS almacenado bajo el origen de la aplicación. Una víctima que abre la URL del SVG o cualquier página que lo incruste podría ver su sesión secuestrada, datos exfiltrados o acciones realizadas en su nombre. Esta vulnerabilidad está corregida en la versión 5.3.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "elabftw",
          "product": "elabftw",
          "versions": [
            {
              "version": "< 5.3.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-28T15:05:27.262314Z",
          "id": "CVE-2025-62793",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/elabftw/elabftw/commit/09b95e38f82f041edac0dd6962c70499e2d8d8e2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/elabftw/elabftw/security/advisories/GHSA-rq98-8jh9-684f",
      "source": "[email protected]"
    }
  ]
}