CVE-2025-24372
2 advisories.
PyPI/ckan CVE-2025-24372: high 7.3
CKAN has an XSS vector in user uploaded images in group/org and user profiles
Action: Upgrade ckan to 2.10.7 or later.
pip install ckan==2.10.7pip install ckan==2.11.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.10.7 | - |
| 2.11.0 | 2.11.2 | - |
Fixed versions
| 2.10.7 | 2.11.2 |
Sources
- osv: GHSA-7pq5-qcp6-mcww
- https://github.com/ckan/ckan/security/advisories/GHSA-7pq5-qcp6-mcww
- https://nvd.nist.gov/vuln/detail/CVE-2025-24372
- https://github.com/ckan/ckan/commit/7da6a26c6183e0a97a356d1b1d2407f3ecc7b9c8
- https://github.com/ckan/ckan/commit/a4fc5e06634ed51d653ab819a7efc8e62f816f68
- https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-group-mimetypes
- https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-group-types
- https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-user-mimetypes
- https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-user-types
- https://github.com/ckan/ckan
CVE-2025-24372 · published · modified · JSON
PyPI/ckan CVE-2025-24372: high 7.3
CKAN has an XSS vector in user uploaded images in group/org and user profiles
Action: Upgrade ckan to 2.10.7 or later.
pip install ckan==2.10.7pip install ckan==2.11.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.10.7 | - |
| 2.11.0 | 2.11.2 | - |
Fixed versions
| 2.10.7 | 2.11.2 |
Sources
- osv: PYSEC-2026-1250
- https://github.com/ckan/ckan/security/advisories/GHSA-7pq5-qcp6-mcww
- https://nvd.nist.gov/vuln/detail/CVE-2025-24372
- https://github.com/ckan/ckan/commit/7da6a26c6183e0a97a356d1b1d2407f3ecc7b9c8
- https://github.com/ckan/ckan/commit/a4fc5e06634ed51d653ab819a7efc8e62f816f68
- https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-group-mimetypes
- https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-group-types
- https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-user-mimetypes
- https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-user-types
- https://github.com/ckan/ckan
- https://pypi.org/project/ckan
- https://github.com/advisories/GHSA-7pq5-qcp6-mcww
CVE-2025-24372 · published · modified · JSON