CVE-2025-59026
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Malicious content uploaded as a file can be used to execute script code when following attacker-controlled links. This can lead to unintended actions in the context of the user's account, including exfiltration of sensitive information.
Risk Assessment
A user may unknowingly execute malicious script, risking data exfiltration and actions performed on their behalf.
Recommendation
Deploy the provided updates and patch releases; no publicly available exploits are known, but patching is required.
Other vulnerabilities in Files
See all- CVE-2025-30186Medium
Malicious content uploaded as a file can be used to execute script code when following attacker-controlled links. This can lead to unintended actions in the context of the user's account, including exfiltration of sensitive information.
- CVE-2025-65963Medium
The Files module for managing files in spaces and user profiles, prior to versions 0.16.11 and 0.17.2, has insufficient authorization checks allowing non-member users to create folders and upload/download files as a ZIP archive in public spaces. Private spaces are not affected.
- CVE-2025-54790Medium
The Files module in versions 0.16.9 and below lacks logic to prevent exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10.
- CVE-2025-54789Medium
The Files module in versions 0.16.9 and below lacks logic to prevent injection of arbitrary JavaScript in the File Move functionality, which can lead to Browser JS code execution in the context of the user's session. This is fixed in version 0.16.10.
Original NVD description (English source)
Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known
Vulnerability data from NVD (NIST) · CISA KEV · EPSS