CVE-2025-62793

MediumCVSS 6.8

Published: 27/10/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

eLabFTW versions prior to 5.3.0 served uploaded SVG files inline. Because SVG supports active content, an attacker could upload a crafted SVG that executes script when viewed, resulting in stored XSS under the application origin. The vulnerability is fixed in version 5.3.0.

Risk Assessment

A victim opening the SVG URL or any page embedding it could have their session hijacked, data exfiltrated, or actions performed on their behalf. The risk affects all eLabFTW users who can view uploaded files.

Recommendation

Update eLabFTW to version 5.3.0 or later. Consider restricting SVG file uploads to trusted users.

Other vulnerabilities in eLabFTW

CVE-2026-28511Medium
In eLabFTW before version 5.4.2, an authenticated user performing a numeric reference/search can return results that include resources the user is not authorized to view. The exposed information is limited to titles, but may include sensitive data such as project names or patient identifiers.

Original NVD description (English source)

eLabFTW is an open source electronic lab notebook for research labs. The application served uploaded SVG files inline. Because SVG supports active content, an attacker could upload a crafted SVG that executes script when viewed, resulting in stored XSS under the application origin. A victim who opens the SVG URL or any page embedding it could have their session hijacked, data exfiltrated, or actions performed on their behalf. This vulnerability is fixed n 5.3.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS