CVE-2025-27406 - CVE House
Back to Database
Status published High CVE-2025-27406

Icinga Reporting Stored XSS leads to SSRF

Vulnerability Description

Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability present in versions 0.10.0 through 1.0.2 allows to set up a template that allows to embed arbitrary Javascript. This enables the attacker to act on behalf of the user, if the template is being previewed; and act on behalf of the headless browser, if a report using the template is printed to PDF. This issue has been resolved in version 1.0.3 of Icinga Reporting. As a workaround, review all templates and remove suspicious settings.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-27406

Credits & Attribution

No credits recorded in the NVD database.

References

More from Icinga

View All →
CVE-2025-61909
Icinga 2 signals sent as root to processes based on PID file written by the Icinga 2 daemon user
Medium 4
CVE-2025-61908
Icinga 2 Denial of Service (DoS) By Dereferencing Invalid Reference
High 7.1
CVE-2025-61907
Icinga 2 API users could access restricted values in filter expressions
High 7.1
CVE-2025-61789
Icinga DB Web hidden/protected custom variables are prone to filter enumeration
Medium 5.3
CVE-2025-53840
Icinga DB Web Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Low 2.4

Affected Vendor

Affected Software

icingaweb2-module-reporting
Vulnerable Versions:
>= 0.10.0, < 1.0.3

Timeline

Official Publish: March 26th, 2025
Last Modified: March 26th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-79 CWE-918

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1046 Network Service Discovery
Discovery