CVE-2025-52880 Details
Description
Komga is a media server for comics, mangas, BDs, magazines and eBooks. A Cross-Site Scripting (XSS) vulnerability has been discovered in versions 1.8.0 through 1.21.3 when serving EPUB resources, either directly from the API, or when reading using the epub reader. The vulnerability lets an attacker perform actions on the victim's behalf. When targeting an admin user, this can be combined with controlling a server-side command to achieve arbitrary code execution. For this vulnerability to be exploited, a malicious EPUB file has to be present in a Komga library, and subsequently accessed in the Epub reader by an admin user. Version 1.22.0 contains a patch for the issue.
A Cross-Site Scripting (XSS) vulnerability has been identified in Komga versions 1.8.0 prior to 1.21.3. This issue arises when EPUB resources are served either directly from the API or through the EPUB reader. The vulnerability allows an attacker to perform actions on behalf of the victim. When targeting an admin user, this XSS can be exploited in conjunction with a server-side command to achieve arbitrary code execution. To exploit this vulnerability, a malicious EPUB file must be uploaded to a Komga library and then accessed by an admin user using the EPUB reader.
Users can upgrade to Komga version 1.22.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2025CISA-ADP
Assessed Jun 24, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gotson/komga/commit/5f9cc449b7846ed2066752c72c9ce7b20c3a85a7 | [email protected] | Source CodeVendor |
| https://github.com/gotson/komga/security/advisories/GHSA-m7mm-6jxp-2m4x | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-799 | Improper Control of Interaction Frequency | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Komga | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2025 | New CVE Received | [email protected] |