CVE-2025-34282

CriticalCVSS 9.1/10Last modified Oct 23, 2026

Description

ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may initiate unintended outbound requests. This can be used to access internal services or resources.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
ThingsBoard, Inc.	ThingsBoard	< 4.2.1

References

https://github.com/thingsboard/thingsboard/pull/13927Issue Tracking
https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1Release Notes
https://www.vulncheck.com/advisories/thingsboard-svg-image-ssrfThird Party Advisory

Timeline

Published: Oct 17, 2025
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-342836.5Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authe CVE-2025-342848.8Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied p CVE-2025-342867.2Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command. Insuff CVE-2025-342877.8Nagios XI versions prior to 2024R2 contain an improperly owned script, process_perfdata.pl, which is executed periodically as the nagios use CVE-2025-342886.7Nagios XI versions prior to 2026R1.1 are vulnerable to local privilege escalation due to an unsafe interaction between sudo permissions and CVE-2025-34294.9The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'material_text' parameter in all versions up to, and including,CVE-2025-342907.8Versa SASE Client for Windows versions released between 7.8.7 and 7.9.4 contain a local privilege escalation vulnerability in the audit log CVE-2025-342918.8Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An over CVE-2025-342929.4Rox, the software running BeWelcome, contains a PHP object injection vulnerability resulting from deserialization of untrusted data. User-co CVE-2025-342938.6GN4 Publishing System versions prior to 2.6 contain an insecure direct object reference (IDOR) vulnerability via the API. Authenticated requ CVE-2025-342978.6KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is CVE-2025-342988.8Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user cou