Cross-Site Scripting Vulnerability in Redmine Package
Summary
DEBIAN-CVE-2025-4011: A vulnerability has been found in Redmine 6.0.0/6.0.1/6.0.2/6.0.3 and classified as problematic. Affects redmine versions < 6.0.4+ds-1. Fixed in 6.0.4+ds-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redmine is an open-source project management web application that provides features such as issue tracking, project planning, and support for various SCM integrations. It is widely used by teams to manage projects and collaborate effectively. However, versions 6.0.0 to 6.0.3 of Redmine have been found to contain a vulnerability in the Custom Query Handler, which can lead to security risks if not addressed.
Vulnerability Detail
A vulnerability has been identified in Redmine versions 6.0.0, 6.0.1, 6.0.2, and 6.0.3, classified as problematic. This issue arises from improper handling of the argument 'Name' in the Custom Query Handler, allowing for cross-site scripting (XSS) attacks. An attacker can exploit this vulnerability remotely, potentially leading to unauthorized access or manipulation of user data.
How To Fix
Minimum fixed version
6.0.4+ds-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade redmineTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected functionality or validate user inputs to mitigate the risk of XSS attacks. However, upgrading to the patched version is the recommended solution.
Conclusion
The identified cross-site scripting vulnerability in Redmine versions 6.0.0 to 6.0.3 poses significant security risks. It is crucial for users to upgrade to version 6.0.4 or later to safeguard their applications against potential attacks. Regular monitoring and vulnerability management, such as using tools like Vulert, can help maintain application security.
See every vulnerability recorded for redmine →
FAQ
The vulnerability is a cross-site scripting (XSS) issue that affects the Custom Query Handler in specific versions of Redmine.
Redmine versions 6.0.0, 6.0.1, 6.0.2, and 6.0.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access, data manipulation, and compromise of user sessions.
While the best solution is to upgrade, you can temporarily restrict access to the affected functionality or implement input validation to reduce the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for redmine.
