CVE-2025-10253
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A vulnerability was found in openDCIM 23.04 affecting unknown code of the file /scripts/uploadifive.php within the SVG File Handler component. Manipulation of the Filedata argument leads to cross site scripting, and the attack can be launched remotely. The exploit has been disclosed to the public and may be used; the vendor did not respond.
Risk Assessment
Malicious script may execute in a user's browser (XSS), potentially leading to session theft or actions performed on behalf of the victim.
Recommendation
Restrict access to the SVG file upload functionality and consider applying patches; until then, enforce input validation and sanitization.
Other vulnerabilities in openDCIM
See all- CVE-2026-28517Critical
openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization.
- CVE-2026-28516High
openDCIM version 23.04 up to commit 4467e9c4 contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.
- CVE-2026-28515High
openDCIM version 23.04 up to commit 4467e9c4 has a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges.
Original NVD description (English source)
A vulnerability has been found in openDCIM 23.04. This vulnerability affects unknown code of the file /scripts/uploadifive.php of the component SVG File Handler. Such manipulation of the argument Filedata leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS