CVE-2025-49590: CryptPad Dom-Based Cross-Site Scripting (XSS) Vulnerability
CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an "early allow" code path that happens before the URI's protocol/scheme is checked, which a maliciously crafted URI can follow. This issue has been patched in version 2025.3.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49590?
CVE-2025-49590 has a medium severity due to its potential for XSS exploitation.
How do I fix CVE-2025-49590?
To fix CVE-2025-49590, upgrade CryptPad to version 2025.3.0 or later.
What impact does CVE-2025-49590 have on CryptPad users?
CVE-2025-49590 allows attackers to bypass the Link Bouncer functionality, potentially leading to XSS attacks.
Who is affected by CVE-2025-49590?
Users of CryptPad versions prior to 2025.3.0 are affected by CVE-2025-49590.
What is the nature of the vulnerability described in CVE-2025-49590?
CVE-2025-49590 is a Cross-Site Scripting (XSS) vulnerability related to the improper filtering of javascript URIs.