CVE-2025-65790 Details
Description
A reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface. FuguHub does not sanitize or restrict script execution inside SVG content. When a victim opens a crafted SVG containing an inline <script> element, the browser executes the attacker-controlled JavaScript.
A reflected cross-site scripting vulnerability has been identified in FuguHub version 8.1. This issue arises when SVG files are served through the '/fs/' file manager interface. FuguHub fails to properly sanitize SVG content, allowing inline script execution. When a user opens a manipulated SVG file containing a script element, the browser executes the embedded JavaScript controlled by the attacker.
Users are advised to strip script tags and event attributes from SVG files, disable inline script execution or enforce sandboxing, apply a strong Content-Security-Policy, restrict SVG uploads or convert them to raster formats like PNG, and sanitize or parse SVG files before serving them through the file manager interface.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 22, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://fuguhub.com/ | [email protected] | Product |
| https://github.com/hunterxxx/FuguHub-8.1-Reflected-SVG-XSS-CVE-2025-65790 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| realtimelogic fuguhub | 8.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 5, 2026 | Initial Analysis | [email protected] |
| Dec 22, 2025 | CVE Modified | CISA-ADP |
| Dec 22, 2025 | New CVE Received | [email protected] |