GitHub Advisoryadvisory · Maven

GHSA-fpq4-r87v-g246 ThingsBoard vulnerable to stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature

MEDIUM Published 2025-10-17 Modified 2026-02-10 Official page ↗
Aliases
CVE-2025-34281
Ecosystem
Maven
Packages
org.thingsboard:application
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-02-10

Affected packages

• Maven org.thingsboard:application: < 4.2.1 → fixed in 4.2.1

Description

ThingsBoard versions < 4.2.1 contain a stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload an SVG file containing malicious JavaScript, which may be executed when the file is rendered in the UI. This issue results from insufficient sanitization and improper content-type validation of uploaded SVG files.

Related

Alias · CVE (1)

  • CVE-2025-34281 ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References