CVE-2025-59026

MEDIUM

OX App Suite < 8.35.110, < 8.39.85, < 8.40.73, < 8.41.67 - Stored Cross-Site Scripting via Malicious File Upload

Title source: llm

Description

Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2025/oxas-adv-2025-0003.json

Scores

CVSS v3 5.4

EPSS 0.0015

EPSS Percentile 5.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (4)

Open-Xchange GmbH/OX App Suite < 8.35.110

Open-Xchange GmbH/OX App Suite < 8.39.85

Open-Xchange GmbH/OX App Suite < 8.40.73

Open-Xchange GmbH/OX App Suite < 8.41.67

Published Nov 27, 2025

Tracked Since Feb 18, 2026