Read the docs
TI-2025-43686 Aliases GHSA-r7pm-mw8g-p7px

Ibexa eZ Platform Admin UI XSS vulnerabilities in back office

Priority LOW 38CWE-79Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Cross-site scripting
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-79.

Summary

### Impact This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vulnerabilities. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and can be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless. ### Patches - See "Patched versions". - https://github.com/ezsystems/ezplatform-admin-ui/commit/acaa620d4ef44e7c20908dc389d48064f2c19e6d ### Workarounds None.

Why it matters now

Fix Fixed ezsystems/ezplatform-admin-ui (Packagist): 2.3.38

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—ezsystems/ezplatform-admin-ui (Packagist)2.3.0-beta1 to before 2.3.382.3.38Patch availableGHSA-r7pm-mw8g-p7px
  • ezsystems/ezplatform-admin-ui (Packagist) Vendor— Affected 2.3.0-beta1 to before 2.3.38 Fixed in 2.3.38 Patch available GHSA-r7pm-mw8g-p7px

Remediation

  • Fix · GHSA-r7pm-mw8g-p7px ezsystems/ezplatform-admin-ui (Packagist) Fixed in 2.3.38 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-r7pm-mw8g-p7px

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences