CVE-2025-64759

Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction required, due to the rendering of a malicious uploaded SVG file. This could be abused to add an attacker's account to the "credentials-admin" group, giving them full administrative access, if a user logged in as an administrator was to view the page which renders or redirects to the SVG. This issue has been patched in version 1.43.3.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.7 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/homarr-labs/homarr/commit/aaa23f37321be1e110f722b36889b2fd3bea2059	Patch Permissions Required
https://github.com/homarr-labs/homarr/security/advisories/GHSA-wj62-c5gr-2x53	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:homarr:homarr:*:*:*:*:*:*:*:*

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Homarr es un panel de control de código abierto. Versiones anteriores a la versión 1.43.3, existe una vulnerabilidad de XSS almacenado, que permite la ejecución de JavaScript arbitrario en el navegador de un usuario, con una interacción mínima o nula del usuario requerida, debido a la renderización de un archivo SVG malicioso subido. Esto podría ser abusado para añadir la cuenta de un atacante al grupo “credentials-admin”, otorgándoles acceso administrativo completo, si un usuario con sesión iniciada como administrador viera la página que renderiza o redirige al SVG. Este problema ha sido parcheado en la versión 1.43.3.

Information

Published : 2025-11-19 19:15

Updated : 2026-10-19 13:10

NVD link : CVE-2025-64759

Mitre link : CVE-2025-64759

CVE.ORG link : CVE-2025-64759

JSON object : View

Products Affected

homarr

homarr

CWE

CWE-20

Improper Input Validation

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2025-64759", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64759", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T21:14:32.106472Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "homarr-labs", "product": "homarr", "versions": [{"status": "affected", "version": "< 1.43.3"}]}]}], "published": "2025-11-19T19:15:49.963", "references": [{"url": "https://github.com/homarr-labs/homarr/commit/aaa23f37321be1e110f722b36889b2fd3bea2059", "tags": ["Patch", "Permissions Required"], "source": "security-advisories@github.com"}, {"url": "https://github.com/homarr-labs/homarr/security/advisories/GHSA-wj62-c5gr-2x53", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-434"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction required, due to the rendering of a malicious uploaded SVG file. This could be abused to add an attacker's account to the \"credentials-admin\" group, giving them full administrative access, if a user logged in as an administrator was to view the page which renders or redirects to the SVG. This issue has been patched in version 1.43.3."}, {"lang": "es", "value": "Homarr es un panel de control de c\u00f3digo abierto. Versiones anteriores a la versi\u00f3n 1.43.3, existe una vulnerabilidad de XSS almacenado, que permite la ejecuci\u00f3n de JavaScript arbitrario en el navegador de un usuario, con una interacci\u00f3n m\u00ednima o nula del usuario requerida, debido a la renderizaci\u00f3n de un archivo SVG malicioso subido. Esto podr\u00eda ser abusado para a\u00f1adir la cuenta de un atacante al grupo \u201ccredentials-admin\u201d, otorg\u00e1ndoles acceso administrativo completo, si un usuario con sesi\u00f3n iniciada como administrador viera la p\u00e1gina que renderiza o redirige al SVG. Este problema ha sido parcheado en la versi\u00f3n 1.43.3."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:homarr:homarr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B201889-9433-4F89-888C-7C83A6487CD7", "versionEndExcluding": "1.43.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}