Read the docs
TI-2025-20578 Aliases CVE-2025-27801GHSA-c873-fj46-wp48

Stored Cross-Site Scripting in Episerver Content Management System (CMS) Media Selection Preview

Priority LOW 21CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The Episerver Content Management System (CMS) by Optimizely was affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. ContentReference properties, which could be used in the "Edit" section of the CMS, offered an upload functionality for documents. These documents could later be used as displayed content on the page. It was possible to upload SVG files that include malicious JavaScript code that would be executed if a user visited the direct URL of the preview image. Attackers needed at least the role "WebEditor" in order to exploit this issue. Affected products: Version 11.X: EPiServer.CMS.Core (<11.21.4) with EPiServer.CMS.UI (<11.37.5), Version 12.X: EPiServer.CMS.Core (<12.22.1) with EPiServer.CMS.UI (<11.37.3)

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00389 33rd percentileScored 2026-11-07
Fix Fixed Episerver Content Management System (CMS) (Optimizely): 11.21.4, 12.22.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OptimizelyEpiserver Content Management System (CMS)11.x to before 11.21.4; 12.x to before 12.22.111.21.4, 12.22.1Patch availableCNA
  • Episerver Content Management System (CMS) VendorOptimizely Affected 11.x to before 11.21.4; 12.x to before 12.22.1 Fixed in 11.21.4, 12.22.1 Patch available CNA

Remediation

  • Fix · CNA Episerver Content Management System (CMS) (Optimizely) Fixed in 11.21.4, 12.22.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Optimizely Episerver Content Management System (CMS) 11.21.4, 12.22.1

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2025-20579 Stored Cross-Site Scripting in Episerver Content Management System (CMS) Edit PreviewPriority LOW 22
    • TI-2025-20577 Stored Cross-Site Scripting in Episerver Content Management System (CMS) Admin DashboardPriority LOW 22
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-27801
  2. 2026-10-03 Alias added: GHSA-c873-fj46-wp48

References

Patch 2

Advisory 1

  • TI-2023-15203 Optimizely CMS UI before v12.16.0 was discovered to contain a cross-site scripting (XSS)… CVSS 3.1MEDIUM 4.8
  • TI-2025-16290 An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. CVSS 3.1HIGH 7.5
  • TI-2025-16287 An issue was discovered in Optimizely Configured Commerce before 5.2.2408. CVSS 3.1HIGH 7.5
  • TI-2025-16284 An issue was discovered in Optimizely Configured Commerce before 5.2.2408. CVSS 3.1HIGH 7.5
  • TI-2025-16289 An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. CVSS 3.1HIGH 8.0
  • TI-2024-37148 In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and… CVSS 3.1HIGH 8.1
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences