CVE-2025-34282
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk75th percentile - higher than 75% of all known CVEs
Summary
An SSRF vulnerability in the Image Upload Gallery feature of ThingsBoard versions prior to 4.2.1 allows an attacker to upload a malicious SVG file referencing a remote URL. Server processing may trigger unintended outbound requests.
Risk Assessment
The risk involves potential access to internal services and resources within the organization's network, which could lead to data leakage or further compromise.
Recommendation
Immediately update ThingsBoard to version 4.2.1 or later, and consider restricting processing of external references in SVG files.
Original NVD description (English source)
ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may initiate unintended outbound requests. This can be used to access internal services or resources.