# CVE-2025-3261: application — Fixed in 4.2.1

☕

☕ Maven

Not in CISA KEV

MEDIUM severity

# CVE-2025-3261 — application

MEDIUM [Fix: thingsboard/thingsboard@b2ae6f9](https://github.com/thingsboard/thingsboard/commit/b2ae6f92d12206ea185a2e882945a6b69234bf03)

CVE-2025-3261 is a medium-severity (CVSS 5.4) vulnerability in org.thingsboard:application. A fix is available for org.thingsboard:application — see the affected versions and patch details below.

ThingsBoard allows an authenticated user to upload malicious SVG images

Also known as[GHSA-5p82-2q3r-wj3m](/vulnerability/GHSA-5p82-2q3r-wj3m)

Published

Nov 27, 2025

Updated

Apr 12, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Apr 12, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Real-World Exposure

1 pkg affected

☕`org.thingsboard:application`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

## Description

ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting (XSS) vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if the malicious images are embedded in an `iframe` element, during a widget creation, deployed to any page of the platform (e.g., dashboards), and accessed during normal operations. The vulnerability resides in the `ImageController`, which fails to restrict the execution of JavaScript code when an image is loaded by the user's browser. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.

## Affected Packages

1 total 1 fixed

Ecosystem

Package

Vulnerable range

Fix

☕Maven

`org.thingsboard:application` 

all versions

4.2.1`org.thingsboard:application:4.2.1`

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.thingsboard:application, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update org.thingsboard:application to 4.2.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-3261 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
    

## Frequently Asked Questions

ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting (XSS) vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if the malicious images are embedded in an \`iframe\` element, during a widget creation, deployed to any page of the platform (e.g., dashboards), and accessed during normal operations. The vulnerability resides in the \`ImageController\`, which fails to restrict the execution of JavaScript code when an image

O3 Security · Impact-Aware SCA

### Is CVE-2025-3261 in your dependencies?

Find it across Maven, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)