CVE-2025-6050: Mezzanine CMS Stored XSS Vulnerability in Admin Interface
Summary
CVE-2025-6050: Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. Affects mezzanine versions < 6.1.1. Fixed in 6.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mezzanine is a powerful content management system (CMS) built using the Django framework. It provides a flexible and easy-to-use interface for managing websites and blogs. Key features include a customizable admin interface, support for multiple content types, and a rich set of plugins. However, versions prior to 6.1.1 are vulnerable to a Stored Cross-Site Scripting (XSS) attack, which can compromise the security of the admin interface.
Vulnerability Detail
The vulnerability arises from the 'displayable_links_js' function in Mezzanine's admin interface, which fails to properly sanitize blog post titles before including them in JSON responses served via '/admin/displayable_links.js'. An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field. If another admin user clicks a direct link to the '/admin/displayable_links.js' endpoint, the malicious script executes in their browser, potentially leading to unauthorized actions or data exposure.
How To Fix
Minimum fixed version
6.1.1
This is the first release that contains the fix.
pip install --upgrade "mezzanine==6.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that only trusted users have admin access to the Mezzanine CMS. Additionally, avoid clicking on suspicious links within the admin interface until the package is updated.
Conclusion
The Stored XSS vulnerability in Mezzanine CMS poses a significant risk to the security of the admin interface. It is crucial for users to update to version 6.1.1 or later to mitigate this risk. Additionally, using Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for mezzanine →
FAQ
A Stored XSS vulnerability allows an attacker to inject malicious scripts into web pages that are viewed by other users. This can lead to unauthorized actions or data theft.
If you are using a version of Mezzanine prior to 6.1.1, your installation is vulnerable to this XSS attack.
If an immediate update is not possible, restrict admin access to trusted users and avoid clicking on untrusted links in the admin interface.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock. You can check if your application is affected without requiring access to the code.
You can find detailed information about CVE-2025-6050 in the official advisory and on vulnerability databases.
Related vulnerabilities
Recent vulnerabilities recorded for mezzanine.
