CVE-2025-66403

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 2.2.3, a stored cross-site scripting (XSS) vulnerability exists in the Filerise application due to improper handling of uploaded SVG files. The application accepts user-supplied SVG uploads without sanitizing or restricting embedded script content. When a malicious SVG containing inline JavaScript or event-based payloads is uploaded, it is later rendered directly in the browser whenever viewed within the application. Because SVGs are XML-based and allow scripting, they execute in the origin context of the application, enabling full stored XSS. This vulnerability is fixed in 2.2.3.

• CWE-79

• https://github.com/error311/FileRise/commit/f2ce43f18f0444f8f63f7c33758d1837dd5ba91ePatch
• https://github.com/error311/FileRise/security/advisories/GHSA-qrcv-vjvf-fr29Exploit, Vendor Advisory

Published

Dec 1, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66398Signal K Server is a server application that runs on a centr…8.8
• CVE-2025-66399Cacti is an open source performance and fault management fra…8.8
• CVE-2025-6640PDF-XChange Editor U3D File Parsing Use-After-Free Remote Co…7.8
• CVE-2025-66400mdast-util-to-hast is an mdast utility to transform to hast.…5.3
• CVE-2025-66401MCP Watch is a comprehensive security scanner for Model Cont…9.8
• CVE-2025-66402Misskey is an open source, federated social media platform. …6.5
• CVE-2025-66404MCP Server Kubernetes is an MCP Server that can connect to a…8.8
• CVE-2025-66405Portkey.ai Gateway is a blazing fast AI Gateway with integra…9.8
• CVE-2025-66406Step CA is an online certificate authority for secure, autom…5
• CVE-2025-66407Weblate is a web based localization tool. The Create Compone…5
• CVE-2025-66409ESF-IDF is the Espressif Internet of Things (IOT) Developmen…9.1
• CVE-2025-6641PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Infor…3.3