Read the docs
TI-2019-10252 Aliases CVE-2019-13645GHSA-5hpw-vcj2-prwg

Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of…

Priority LOW 26CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript code is executed during attachments/edit/$file_id$ attachment editing. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability

Why it matters now

EPSS 0.00762 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed grumpydictator/firefly-iii (Packagist): 4.7.17.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—grumpydictator/firefly-iii (Packagist)before 4.7.17.34.7.17.3Patch availableGHSA-5hpw-vcj2-prwg
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • grumpydictator/firefly-iii (Packagist) Vendor— Affected before 4.7.17.3 Fixed in 4.7.17.3 Patch available GHSA-5hpw-vcj2-prwg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:firefly-iii:firefly_iii:*:*:*:*:*:*:*:*before 4.7.17.3Vulnerablefirefly-iii
  • cpe:2.3:a:firefly-iii:firefly_iii:*:*:*:*:*:*:*:* Versions before 4.7.17.3 Vulnerable ·firefly-iii

Remediation

  • Fix · GHSA-5hpw-vcj2-prwg grumpydictator/firefly-iii (Packagist) Fixed in 4.7.17.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-13645
  2. 2026-10-03 Alias added: GHSA-5hpw-vcj2-prwg

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2023-01681 Improper Input Validation in firefly-iii/firefly-iii CVSS 3.1CRITICAL 9.8
  • TI-2023-01680 Insufficient Session Expiration in firefly-iii/firefly-iii CVSS 3.1CRITICAL 9.8
  • TI-2023-00283 Incorrect Authorization in firefly-iii/firefly-iii CVSS 3.1MEDIUM 6.5
  • TI-2019-10251 Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of… CVSS 3.1MEDIUM 5.4
  • TI-2021-02811 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii CVSS 3.1HIGH 8.8
  • TI-2021-02777 Unrestricted Upload of File with Dangerous Type in firefly-iii/firefly-iii CVSS 3.1HIGH 8.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences