CVE-2025-55944

MediumCVSS 6.1

Published: 03/09/2025(UTC)Updated: 07/11/2026(UTC)Translated: 07/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

Slink v1.4.9 allows stored cross-site scripting (XSS) via crafted SVG uploads. When a user views the shared image in a new browser tab, the embedded JavaScript executes.

Risk Assessment

The issue affects both authenticated and unauthenticated users, potentially leading to session theft or other attacks in the victim's browser context.

Recommendation

Update Slink to a version that properly sanitizes SVG files or prevents script embedding, and implement a Content Security Policy (CSP).

Other vulnerabilities in Slink

CVE-2026-85605Medium
Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/{imageId}/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on public images and subscribe to live comment updates without authentication or authorization checks.

Original NVD description (English source)

Slink v1.4.9 allows stored cross-site scripting (XSS) via crafted SVG uploads. When a user views the shared image in a new browser tab, the embedded JavaScript executes. The issue affects both authenticated and unauthenticated users.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS