CVE-2025-52880

Komga is a media server for comics, mangas, BDs, magazines and eBooks. A Cross-Site Scripting (XSS) vulnerability has been discovered in versions 1.8.0 through 1.21.3 when serving EPUB resources, either directly from the API, or when reading using the epub reader. The vulnerability lets an attacker perform actions on the victim's behalf. When targeting an admin user, this can be combined with controlling a server-side command to achieve arbitrary code execution. For this vulnerability to be exploited, a malicious EPUB file has to be present in a Komga library, and subsequently accessed in the Epub reader by an admin user. Version 1.22.0 contains a patch for the issue.

• CWE-799

• https://github.com/gotson/komga/commit/5f9cc449b7846ed2066752c72c9ce7b20c3a85a7
• https://github.com/gotson/komga/security/advisories/GHSA-m7mm-6jxp-2m4x

Published

Jun 24, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-52875In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at th…5.4
• CVE-2025-52876In JetBrains TeamCity before 2025.03.3 reflected XSS on the …5.4
• CVE-2025-52877In JetBrains TeamCity before 2025.03.3 reflected XSS on disk…4.8
• CVE-2025-52878In JetBrains TeamCity before 2025.03.3 usernames were expose…4.3
• CVE-2025-52879In JetBrains TeamCity before 2025.03.3 reflected XSS in the …4.8
• CVE-2025-5288The REST API | Custom API Generator For Cross Platform And I…9.8
• CVE-2025-52881runc is a CLI tool for spawning and running containers accor…7.5
• CVE-2025-52882Claude Code is an agentic coding tool. Claude Code extension…8.8
• CVE-2025-52883Meshtastic-Android is an Android application for the mesh ra…5.3
• CVE-2025-52884RISC Zero is a zero-knowledge verifiable general computing p…1.7
• CVE-2025-52885Poppler ia a library for rendering PDF files, and examining …6.1
• CVE-2025-52886Poppler is a PDF rendering library. Versions prior to 25.06.…5.9