CVE-2025-13058
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A cross-site scripting vulnerability was discovered in soerennb eXtplorer up to 2.1.15 in the Filename Handler component. The attack can be launched remotely and a patch is available as commit 002def70b985f7012586df2c44368845bf405ab3.
Risk Assessment
An attacker could execute malicious script in a file manager user's browser, potentially leading to session theft or actions on behalf of the victim. Risk applies to network-accessible eXtplorer installations.
Recommendation
Apply the available patch (commit 002def70b985f7012586df2c44368845bf405ab3) or update eXtplorer to a patched version. Restrict web interface access to trusted networks.
Other vulnerabilities in eXtplorer
See all- CVE-2017-12756High
In extplorer versions 2.1.9 and prior, there is a command injection vulnerability in the transfer function from another server, allowing an attacker to inject commands via the userfile[0] parameter.
- CVE-2016-4313High
Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitrary files via a .. (dot dot) in an archive file.
Original NVD description (English source)
A security flaw has been discovered in soerennb eXtplorer up to 2.1.15. The affected element is an unknown function of the component Filename Handler. The manipulation results in cross site scripting. The attack may be launched remotely. The patch is identified as 002def70b985f7012586df2c44368845bf405ab3. Applying a patch is advised to resolve this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS