Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

ibexa/admin-ui-assets

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.1PackagistPublished

    Ibexa Admin UI assets XSS vulnerabilities in back office

    GHSA-vhgq-r8gx-5fpv

    Affected
    • Packagist ibexa/admin-ui-assets >= 4.6.0-alpha1, < 4.6.21
    Fixed in
    4.6.21· Vendor fix available
    Issue
    Impact This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vulnerabilities. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and can be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless. Patches - See "Patched versions". - https://github.com/ibexa/admin-ui-assets/commit/219b71b70aaea9321947d2dbeb49fff1b49e05f4 Workarounds None.

    Recommended action: Upgrade to 4.6.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →