CVE-2025-29573 Details

A persistent Cross-Site Scripting (XSS) vulnerability has been identified in Mezzanine CMS version 6.0.0. The issue arises in the Forms module, specifically within the 'View Entries' feature. When an administrator views form submissions that include a File Upload field, the names of the uploaded files are not properly sanitized. This allows an attacker to inject a malicious JavaScript payload into the filename, which is executed in the administrator's browser when the file is accessed. The vulnerability is caused by unsafe rendering of filenames through direct HTML interpolation without adequate escaping.

Project maintainers should be contacted for a patch. In the meantime, file names and other user inputs should be sanitized before being rendered as HTML. Avoid using the 'mark_safe' function on untrusted content unless it has been properly escaped.