Vulnerability Description
Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction required, due to the rendering of a malicious uploaded SVG file. This could be abused to add an attacker's account to the "credentials-admin" group, giving them full administrative access, if a user logged in as an administrator was to view the page which renders or redirects to the SVG. This issue has been patched in version 1.43.3.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Homarr | Homarr | < 1.43.3 |
Related Weaknesses (CWE)
References
- https://github.com/homarr-labs/homarr/commit/aaa23f37321be1e110f722b36889b2fd3bePatchPermissions Required
- https://github.com/homarr-labs/homarr/security/advisories/GHSA-wj62-c5gr-2x53PatchVendor Advisory
FAQ
What is CVE-2025-64759?
CVE-2025-64759 is a vulnerability with a CVSS score of 8.1 (HIGH). Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction re...
How severe is CVE-2025-64759?
CVE-2025-64759 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-64759?
Check the references section above for vendor advisories and patch information. Affected products include: Homarr Homarr.