CVE-2025-34281: ThingsBoard Application Vulnerable to Stored XSS in Image Upload Gallery
Summary
CVE-2025-34281: ThingsBoard versions < 4.2.1 contain a stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature. Affects org.thingsboard:application versions < 4.2.1. Fixed in 4.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ThingsBoard is an open-source IoT platform that enables users to manage and visualize data from connected devices. It provides a dashboard feature that allows users to upload images for enhanced data presentation. However, certain versions of ThingsBoard are susceptible to a stored cross-site scripting (XSS) vulnerability, which can compromise the security of the application and its users.
Vulnerability Detail
ThingsBoard versions prior to 4.2.1 contain a stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature. This vulnerability arises from insufficient sanitization and improper content-type validation of uploaded SVG files. An attacker can exploit this flaw by uploading an SVG file containing malicious JavaScript. When the file is rendered in the user interface, the malicious script may execute, potentially leading to unauthorized actions or data exposure.
How To Fix
Minimum fixed version
4.2.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the types of files that can be uploaded to the Image Upload Gallery. Ensure that only safe file types (e.g., JPEG, PNG) are allowed, and implement server-side validation to reject any SVG files or other potentially harmful formats.
Conclusion
In summary, the ThingsBoard application is vulnerable to a stored cross-site scripting (XSS) issue in its Image Upload Gallery feature, affecting versions prior to 4.2.1. It is crucial to update to the latest version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for org.thingsboard:application →
FAQ
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability could allow attackers to execute malicious scripts in the context of the user's session, leading to data theft, unauthorized actions, or other security breaches.
While updating to the patched version is the best solution, you can mitigate the risk by restricting file uploads to safe formats and implementing strict server-side validation.
ThingsBoard versions prior to 4.2.1 are affected by this stored XSS vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.thingsboard:application.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
