Read the docs
TI-2019-10251 Aliases CVE-2019-13644GHSA-9xmx-rj7j-fv9q

Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of…

Priority MEDIUM 58CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a transaction, and is executed on the tags/show/$tag_number$ tag summary page. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00762 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed grumpydictator/firefly-iii (Packagist): 4.7.17.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—grumpydictator/firefly-iii (Packagist)before 4.7.17.14.7.17.1Patch availableGHSA-9xmx-rj7j-fv9q
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • grumpydictator/firefly-iii (Packagist) Vendor— Affected before 4.7.17.1 Fixed in 4.7.17.1 Patch available GHSA-9xmx-rj7j-fv9q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:firefly-iii:firefly_iii:*:*:*:*:*:*:*:*before 4.7.17.1Vulnerablefirefly-iii
  • cpe:2.3:a:firefly-iii:firefly_iii:*:*:*:*:*:*:*:* Versions before 4.7.17.1 Vulnerable ·firefly-iii

Remediation

  • Fix · GHSA-9xmx-rj7j-fv9q grumpydictator/firefly-iii (Packagist) Fixed in 4.7.17.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-13644
  2. 2026-10-03 Alias added: GHSA-9xmx-rj7j-fv9q

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2023-01681 Improper Input Validation in firefly-iii/firefly-iii CVSS 3.1CRITICAL 9.8
  • TI-2023-01680 Insufficient Session Expiration in firefly-iii/firefly-iii CVSS 3.1CRITICAL 9.8
  • TI-2023-00283 Incorrect Authorization in firefly-iii/firefly-iii CVSS 3.1MEDIUM 6.5
  • TI-2021-02811 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii CVSS 3.1HIGH 8.8
  • TI-2021-02777 Unrestricted Upload of File with Dangerous Type in firefly-iii/firefly-iii CVSS 3.1HIGH 8.8
  • TI-2021-02750 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii CVSS 3.1HIGH 8.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences