Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.thingsboard:application

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.2MavenPublished

    ThingsBoard allows an authenticated user to upload malicious SVG images

    CVE-2025-3261 · GHSA-5p82-2q3r-wj3m

    Affected
    • Maven org.thingsboard:application < 4.2.1
    Fixed in
    4.2.1· Vendor fix available
    Issue
    ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting (XSS) vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if the malicious images are embedded in an iframe element, during a widget creation, deployed to any page of the platform (e.g., dashboards), and accessed during normal operations. The vulnerability resides in the ImageController, which fails to restrict the execution of JavaScript code when an image is loaded by the user's browser. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.

    Recommended action: Upgrade to 4.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 5.1MavenPublished

    ThingsBoard vulnerable to stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature

    CVE-2025-34281 · GHSA-fpq4-r87v-g246

    Affected
    • Maven org.thingsboard:application < 4.2.1
    Fixed in
    4.2.1· Vendor fix available
    Issue
    ThingsBoard versions < 4.2.1 contain a stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload an SVG file containing malicious JavaScript, which may be executed when the file is rendered in the UI. This issue results from insufficient sanitization and improper content-type validation of uploaded SVG files.

    Recommended action: Upgrade to 4.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →