Vulnerability Description
ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may initiate unintended outbound requests. This can be used to access internal services or resources.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Thingsboard | Thingsboard | < 4.2.1 |
Related Weaknesses (CWE)
References
- https://github.com/thingsboard/thingsboard/pull/13927Issue Tracking
- https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1Release Notes
- https://www.vulncheck.com/advisories/thingsboard-svg-image-ssrfThird Party Advisory
FAQ
What is CVE-2025-34282?
CVE-2025-34282 is a vulnerability with a CVSS score of 9.1 (CRITICAL). ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a r...
How severe is CVE-2025-34282?
CVE-2025-34282 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-34282?
Check the references section above for vendor advisories and patch information. Affected products include: Thingsboard Thingsboard.