CVE-2025-7066

Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scripting. This was done by storing the MIME type of a file and allowing only browser preview for MIME types beginning with image (except for image/svg+xml, see CVE-2022-30110 and CVE-2024-12326), video and audio. However, it was possible to bypass this check by sending a manipulated MIME type containing a comma and an other MIME type like text/html (for example image/png,text/html). Browsers see multiple MIME types and text/html would takes precedence, allowing a possible attacker to do a cross-site scripting attack. The check for MIME types was enhanced to prevent a browser preview when the stored MIME type contains a comma.

• CWE-79

• https://gitlab.com/jirafeau/Jirafeau/-/commit/79464ec6276e8eb0e0b0ad597db02b85080d2b63Patch
• https://www.cve.org/CVERecord?id=CVE-2022-30110Third Party Advisory
• https://www.cve.org/CVERecord?id=CVE-2024-12326Third Party Advisory

Published

Jul 4, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-70646Tenda AX1803 v1.0.0.1 was discovered to contain a stack over…7.5
• CVE-2025-70648Tenda AX1803 v1.0.0.1 was discovered to contain a stack over…7.5
• CVE-2025-7065Due to client-controlled permission check parameter, PAD CMS…9.8
• CVE-2025-70650Tenda AX-1806 v1.0.0.1 was discovered to contain a stack ove…7.5
• CVE-2025-70651Tenda AX-1803 v1.0.0.1 was discovered to contain a stack ove…7.5
• CVE-2025-70656Tenda AX-1806 v1.0.0.1 was discovered to contain a stack ove…7.5
• CVE-2025-7067A vulnerability classified as problematic was found in HDF5 …5.5
• CVE-2025-7068A vulnerability, which was classified as problematic, has be…5.5
• CVE-2025-7069A vulnerability, which was classified as problematic, was fo…5.5
• CVE-2025-7070A vulnerability has been found in IROAD Dashcam Q9 up to 202…8.8
• CVE-2025-7071Padding oracle attack vulnerability in Oberon microsystem AG…5.9
• CVE-2025-7072The firmware in KAON CG3000TC and CG3000T routers contains h…9.3