{"action":"Upgrade org.thingsboard:application to 4.2.1 or later.","affected":[{"fixed":"4.2.1","introduced":"0"}],"component":"org.thingsboard:application","cve_ids":["CVE-2025-34281"],"ecosystem":"Maven","epss":0.00387,"exploited":false,"fixed_versions":["4.2.1"],"ghsa_id":"GHSA-fpq4-r87v-g246","id":"tcs_01M5N8WGJEWMXJHQRSQD2K670Y","modified_at":"2026-02-10T21:56:17.870336Z","published_at":"2025-10-17T21:31:17Z","references":["https://osv.dev/vulnerability/GHSA-fpq4-r87v-g246","https://nvd.nist.gov/vuln/detail/CVE-2025-34281","https://github.com/thingsboard/thingsboard/pull/13927","https://github.com/thingsboard/thingsboard/commit/b2ae6f92d12206ea185a2e882945a6b69234bf03","https://advisory.checkmarx.net/advisory/CVE-2025-3261","https://advisory.checkmarx.net/advisory/CVE-2025-34281","https://github.com/thingsboard/thingsboard","https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1","https://www.vulncheck.com/advisories/thingsboard-svg-image-stored-xss"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-fpq4-r87v-g246","url":"https://osv.dev/vulnerability/GHSA-fpq4-r87v-g246"}],"summary":"ThingsBoard vulnerable to stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature"}