CVE-2025-62793 - CVE House

Back to Database

Status published Medium CVE-2025-62793

eLabFTW HTML / CSS Injection via Malicious SVG Upload Leads to Credential Theft / Clickjacking

6.8 CVSS

Vulnerability Description

eLabFTW is an open source electronic lab notebook for research labs. The application served uploaded SVG files inline. Because SVG supports active content, an attacker could upload a crafted SVG that executes script when viewed, resulting in stored XSS under the application origin. A victim who opens the SVG URL or any page embedding it could have their session hijacked, data exfiltrated, or actions performed on their behalf. This vulnerability is fixed n 5.3.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62793

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from elabftw

View All →

Incorrect input validation could allow an authenticated user to read sensitive information

eLabFTW MFA bypass

eLabFTW vulnerable to HTML Injection in extended search error message

eLabFTW contains a direct and indirect information disclosure

Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw

Affected Vendor

elabftw

View all reports →

Affected Software

elabftw

Vulnerable Versions:

< 5.3.0

Timeline

Official Publish: October 27th, 2025

Last Modified: October 28th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement