CVE-2025-57292

MediumCVSS 6.1

Published: 26/09/2025(UTC)Updated: 05/11/2026(UTC)Translated: 06/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The application fails to properly validate the MIME type and sanitize image metadata.

Risk Assessment

An attacker can upload a malicious file that executes script in other users' browsers, potentially leading to session hijacking or data theft.

Recommendation

Improve MIME type validation and image metadata sanitization, and implement output encoding.

Other vulnerabilities in Todoist

CVE-2025-63317Medium
Todoist v8896 is vulnerable to Cross Site Scripting (XSS) in /api/v1/uploads. Uploaded SVG files are not sanitized, so embedded JavaScript executes when a user opens the attachment from a task or comment.

Original NVD description (English source)

Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The application fails to properly validate the MIME type and sanitize image metadata.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS