CVE-2025-64759

MediumCVSS 6.1/10Last modified Oct 19, 2026

Description

Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction required, due to the rendering of a malicious uploaded SVG file. This could be abused to add an attacker's account to the "credentials-admin" group, giving them full administrative access, if a user logged in as an administrator was to view the page which renders or redirects to the SVG. This issue has been patched in version 1.43.3.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-20 CWE-434

Affected software

Vendor	Product	Versions
homarr-labs	homarr	< 1.43.3

References

https://github.com/homarr-labs/homarr/commit/aaa23f37321be1e110f722b36889b2fd3bea2059Patch, Permissions Required
https://github.com/homarr-labs/homarr/security/advisories/GHSA-wj62-c5gr-2x53Patch, Vendor Advisory

Timeline

Published: Nov 19, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-64764.3A vulnerability was found in SourceCodester Gym Management System 1.0. It has been classified as problematic. Affected is an unknown functio CVE-2025-647604.3Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior CVE-2025-647617.2OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity gro CVE-2025-647629.1The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. I CVE-2025-647635.3Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP pro CVE-2025-647645.4Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the t CVE-2025-647655.3Astro is a web framework. Prior to version 5.15.8, a mismatch exists between how Astro normalizes request paths for routing/rendering and ho CVE-2025-647665.3NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions CVE-2025-647679.1hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderConte CVE-2025-647697.1The Process Optimization application suite leverages connection channels/protocols that by-default are not encrypted and could become subj CVE-2025-64774.8A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as problematic. Affected by this vuln CVE-2025-647706.8The affected products allow unauthenticated access to Open Network Video Interface Forum (ONVIF) services, which may allow an attacker unaut