Read the docs
TI-2025-43688 Aliases GHSA-vhgq-r8gx-5fpv

Ibexa Admin UI assets XSS vulnerabilities in back office

Priority LOW 38CWE-79Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Cross-site scripting
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-79.

Summary

### Impact This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vulnerabilities. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and can be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless. ### Patches - See "Patched versions". - https://github.com/ibexa/admin-ui-assets/commit/219b71b70aaea9321947d2dbeb49fff1b49e05f4 ### Workarounds None.

Why it matters now

Fix Fixed ibexa/admin-ui-assets (Packagist): 4.6.21

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—ibexa/admin-ui-assets (Packagist)4.6.0-alpha1 to before 4.6.214.6.21Patch availableGHSA-vhgq-r8gx-5fpv
  • ibexa/admin-ui-assets (Packagist) Vendor— Affected 4.6.0-alpha1 to before 4.6.21 Fixed in 4.6.21 Patch available GHSA-vhgq-r8gx-5fpv

Remediation

  • Fix · GHSA-vhgq-r8gx-5fpv ibexa/admin-ui-assets (Packagist) Fixed in 4.6.21 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-vhgq-r8gx-5fpv

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences