CVE-2025-63317

MEDIUM

Todoist v8896 - Stored Cross-Site Scripting via SVG File Upload

Title source: llm

Description

Todoist v8896 is vulnerable to Cross Site Scripting (XSS) in /api/v1/uploads. Uploaded SVG files have no sanitization applied, so embedded JavaScript executes when a user opens the attachment from a task/comment.

References (1)

Core 1

Core References

Exploit, Third Party Advisory

https://github.com/sefabasnak/Todoistv8896

View Exploit ZIP pw:eip

Scores

CVSS v3 5.4

EPSS 0.0018

EPSS Percentile 7.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

doist/todoist 8486

Published Dec 01, 2025

Tracked Since Feb 18, 2026