CryptPad Dom-Based Cross-Site Scripting (XSS) Vulnerability
Priority MEDIUM 48CWE-692Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an "early allow" code path that happens before the URI's protocol/scheme is checked, which a maliciously crafted URI can follow. This issue has been patched in version 2025.3.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00329 26th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed cryptpad (cryptpad): 2025.3.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA cryptpad (cryptpad) Fixed in 2025.3.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-49590
References
More XWiki Cryptpad vulnerabilities
- TI-2025-31604 CryptPad 2FA Bypass Vulnerability CVSS 4.0HIGH 7.4
- TI-2025-32422 CryptPad unbounded WebSocket frame flood CVSS 4.0HIGH 8.7
- TI-2019-11412 The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker… CVSS 3.1MEDIUM 6.5
- TI-2017-14392 Cross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before… CVSS 3.0MEDIUM 6.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences