CVE-2025-30186

MEDIUM

OX App Suite < 8.35.107, < 8.38.89, < 8.39.83, < 8.40.68, < 8.41.60 - Stored XSS via File Upload

Title source: llm
STIX 2.1

Description

Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known

References (1)

Core 1

Scores

CVSS v3 5.4
EPSS 0.0015
EPSS Percentile 5.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (5)
Open-Xchange GmbH/OX App Suite < 8.35.107
Open-Xchange GmbH/OX App Suite < 8.38.89
Open-Xchange GmbH/OX App Suite < 8.39.83
Open-Xchange GmbH/OX App Suite < 8.40.68
Open-Xchange GmbH/OX App Suite < 8.41.60
Published Nov 27, 2025
Tracked Since Feb 18, 2026