Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
10 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact This security advisory resolves an XSS vulnerability in image asset names, content language names and future publishing in the back office of the DXP. Back office access and varying levels of editing and management permissions are required to exploit this vulnerability. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and may in some cases be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless. Patches See "Patched versions". Workarounds None. References https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office
Recommended action: Upgrade to 2.3.39 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vulnerabilities. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and can be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless. Patches - See "Patched versions". - https://github.com/ezsystems/ezplatform-admin-ui/commit/acaa620d4ef44e7c20908dc389d48064f2c19e6d Workarounds None.
Recommended action: Upgrade to 2.3.38 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The file upload widget is vulnerable to XSS payloads in filenames. Access permission to upload files is required. As such, in most cases only authenticated editors and administrators will have the required permission. It is not persistent, i.e. the payload is only executed during the upload. In effect, an attacker will have to trick an editor/administrator into uploading a strangely named file. The fix ensures XSS is escaped. Patches See "Patched versions". Commit: https://github.com/ezsystems/ezplatform-admin-ui/commit/7a9f991b200fa5a03d49cd07f50577c8bc90a30b Workarounds None. References - https://developers.ibexa.co/security-advisories/ibexa-sa-2024-004-dom-based-xss-in-file-upload - https://github.com/ezsystems/ezplatform-admin-ui/commit/7a9f991b200fa5a03d49cd07f50577c8bc90a30b - https://github.com/ibexa/admin-ui/security/advisories/GHSA-qm44-wjm2-pr59 Credit This vulnerability was discovered and reported to Ibexa by Alec Romano: https://github.com/4rdr We thank them for…
Recommended action: Upgrade to 3.3.39 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This security advisory fixes a severe vulnerability in the eZ Platform Admin UI, and we recommend that you install it as soon as possible. Parts of the Admin UI are vulnerable to XSS injection. All 2.x sites are at risk, and particularly those that allow user generated content. The update adds the necessary escaping of injected code. This resolves the issue both for code that has already been injected, and any future such code. To install, use Composer to update "ezsystems/ezplatform-admin-ui" and "ezsystems/ezplatform-page-builder" to one of the "Resolving versions" mentioned above. (ezplatform-page-builder exists only in eZ Platform Enterprise Edition.)
Recommended action: Upgrade to 1.4.4 or 1.3.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This Security Update fixes a severe vulnerability in the eZ Platform Admin UI, and we recommend that you install it as soon as possible. It affects eZ Platform 2.x. The functionality for resetting a forgotten password is vulnerable to brute force attack. Depending on configuration and other circumstances an attacker may exploit this to gain control over user accounts. The update ensures such an attack is exceedingly unlikely to succeed. You may want to consider a configuration change to further strengthen your security. By default a password reset request is valid for 1 hour. Reducing this time will make attacks even more difficult, but ensure there is enough time left to account for email delivery delays, and user delays. See documentation at https://doc.ezplatform.com/en/latest/guide/usermanagement/#changing-and-recovering-passwords To install, use Composer to update to one of the "Resolving versions" mentioned above. If you use eZ Platform 2.5, update ezsystems/ezplatform-user to…
Recommended action: Upgrade to 1.4.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
Recommended action: Upgrade to 2.3.26 or 1.5.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It is possible to inject JavaScript XSS in the content type entries "name" and "short name". To exploit this, one must already have permission to edit content types, which limits it in many cases to people who are already administrators. However, please verify which users have this permission. The fix ensures any injections are escaped.
Recommended action: Upgrade to 2.3.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4.
Recommended action: Upgrade to 1.4.4 or 1.3.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. This affects eZ Platform v2.5 only. The maintainers resolved it by replacing node-sass 4.11 with sass 1.32.13. This issue also affects ezsystems/ezplatform and ezsystems/ezplatform-page-builder.
Recommended action: Upgrade to 1.5.27 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editors. The fix ensures custom tag attribute data is escaped in the editor.
Recommended action: Upgrade to 1.5.25.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.