CVE-2025-62793 - eLabFTW HTML / CSS Injection via Malicious SVG Upload Leads to Credential Theft / Clickjacking

Back Back to CVE browser

MEDIUM

eLabFTW HTML / CSS Injection via Malicious SVG Upload Leads to Credential Theft / Clickjacking

Published Oct 27, 2025

6.8

MEDIUM

CVSS 3.1

EPSS 0.26%

Description

eLabFTW is an open source electronic lab notebook for research labs. The application served uploaded SVG files inline. Because SVG supports active content, an attacker could upload a crafted SVG that executes script when viewed, resulting in stored XSS under the application origin. A victim who opens the SVG URL or any page embedding it could have their session hijacked, data exfiltrated, or actions performed on their behalf. This vulnerability is fixed n 5.3.0.

Affected products

Vendor Elabftw Product Elabftw Default
n/a
- Version
  < 5.3.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Elabftw

n/a

Version	Status	Constraints
< 5.3.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-36380
Advisory
https://github.com/elabftw/elabftw/commit/09b95e38f82f041edac0dd6962c70499e2d8d8e2
x_refsource_MISC
https://github.com/elabftw/elabftw/security/advisories/GHSA-rq98-8jh9-684f
x_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-36380		Advisory
https://github.com/elabftw/elabftw/commit/09b95e38f82f041edac0dd6962c70499e2d8d8e2		x_refsource_MISC
https://github.com/elabftw/elabftw/security/advisories/GHSA-rq98-8jh9-684f		x_refsource_CONFIRM