CVE-2025-52559

Zulip is an open-source team chat application. From versions 2.0.0-rc1 to before 10.4 in Zulip Server, the /digest/ URL of a server shows a preview of what the email weekly digest would contain. This URL, though not the digest itself, contains a cross-site scripting (XSS) vulnerability in both topic names and channel names. This issue has been fixed in Zulip Server 10.4. A workaround for this issue involves denying access to /digest/.

• CWE-79

• https://github.com/zulip/zulip/commit/175ec1f365b0db982d6eac9019701cbf6e8bc2f2Patch
• https://github.com/zulip/zulip/commit/1a8429e338ff53bdcc4b42e7e71b6fffdd84fcd1Patch
• https://github.com/zulip/zulip/commit/6608c8777254e73a4b540e5e1c4af92e680a55fcPatch
• https://github.com/zulip/zulip/security/advisories/GHSA-vgf2-vw4r-m663Patch, Vendor Advisory

Published

Jul 2, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-52553authentik is an open-source identity provider. After authori…9.6
• CVE-2025-52554n8n is a workflow automation platform. Prior to version 1.99…4.3
• CVE-2025-52555Ceph is a distributed object, block, and file storage platfo…6.5
• CVE-2025-52556rfc3161-client is a Python library implementing the Time-Sta…9.3
• CVE-2025-52557Mail-0's Zero is an open-source email solution. In version 0…8.6
• CVE-2025-52558changedetection.io is a free open source web page change det…7
• CVE-2025-5256SummaryThis advisory addresses an Open Redirection vulnerabi…5.4
• CVE-2025-52560Kanboard is project management software that focuses on the …8.8
• CVE-2025-52561HTMLSanitizer.jl is a Whitelist-based HTML sanitizer. Prior …6.9
• CVE-2025-52562Convoy is a KVM server management panel for hosting business…10
• CVE-2025-52563Chamilo is a learning management system. Prior to version 1.…6.1
• CVE-2025-52564Chamilo is a learning management system. Prior to version 1.…6.1