CVE-2025-66403 Details
Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 2.2.3, a stored cross-site scripting (XSS) vulnerability exists in the Filerise application due to improper handling of uploaded SVG files. The application accepts user-supplied SVG uploads without sanitizing or restricting embedded script content. When a malicious SVG containing inline JavaScript or event-based payloads is uploaded, it is later rendered directly in the browser whenever viewed within the application. Because SVGs are XML-based and allow scripting, they execute in the origin context of the application, enabling full stored XSS. This vulnerability is fixed in 2.2.3.
A stored cross-site scripting vulnerability has been identified in FileRise versions prior to 2.2.3. This issue arises from the application's improper handling of uploaded SVG files. FileRise allows user-supplied SVG uploads without sanitizing or restricting embedded script content. Consequently, when a malicious SVG containing inline JavaScript or event-based payloads is uploaded, it is rendered directly in the browser within the application. Since SVGs are XML-based and can include scripts, they execute in the context of the application, leading to full stored cross-site scripting exploitation.
Users are advised to update FileRise to version 2.2.3 or later. This update modifies how SVG uploads are managed to prevent the execution of inline scripts. As a temporary measure, .svg uploads can be blocked or served strictly as downloadable files.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 2, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| filerise filerise | < 2.2.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 7, 2026 | Initial Analysis | [email protected] |
| Dec 1, 2025 | New CVE Received | [email protected] |