Cross-Site Scripting Vulnerability in Icinga Reporting (CVE-2025-27406)
Summary
CVE-2025-27406: Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. Affects icingaweb2-module-reporting versions < 2eb28aa306dbf26c370990ec7e8ce89ae248c573. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Icinga Reporting is a crucial component of the Icinga Web 2 monitoring framework, designed to provide reporting functionalities for system monitoring. It allows users to create and manage reports based on monitoring data. However, versions 0.10.0 through 1.0.2 of Icinga Reporting are susceptible to a vulnerability that permits the embedding of arbitrary JavaScript in report templates, posing significant security risks.
Vulnerability Detail
The vulnerability identified as CVE-2025-27406 arises from the ability to create templates that can execute arbitrary JavaScript code. This flaw can be exploited by attackers to perform actions on behalf of users when templates are previewed or to manipulate headless browsers when reports are printed to PDF. The issue is rooted in insufficient validation of template content, allowing malicious scripts to be embedded and executed.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should review all existing templates and eliminate any suspicious settings that may allow for the embedding of JavaScript.
Conclusion
CVE-2025-27406 represents a significant security risk for users of Icinga Reporting versions 0.10.0 to 1.0.2. It is crucial to update to version 1.0.3 or later to mitigate this vulnerability. Users should also review their templates for any suspicious settings as a precautionary measure.
See every vulnerability recorded for icingaweb2-module-reporting →
FAQ
CVE-2025-27406 is a vulnerability in Icinga Reporting that allows the embedding of arbitrary JavaScript in report templates, potentially leading to unauthorized actions.
Versions 0.10.0 through 1.0.2 of Icinga Reporting are vulnerable to this issue.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If updating is not feasible, ensure to review and sanitize all templates to remove any potentially harmful settings as a temporary measure.
Failing to address this vulnerability could allow attackers to execute malicious scripts, compromising user accounts and potentially leading to data breaches.
Related vulnerabilities
Recent vulnerabilities recorded for icingaweb2-module-reporting.
