CVE-2025-14202

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-14202

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-14202.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-14202

Published

2025-12-17T23:35:17.515Z

Modified

2026-07-15T01:49:02.975645585Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N CVSS Calculator

Summary

Cross-Site Request Forgery (CSRF) Leading to Account Takeover via SVG File Upload

Details

A vulnerability in the file upload at bookmark + asset rendering pipeline allows an attacker to upload a malicious SVG file with JavaScript content. When an authenticated admin user views the SVG file with embedded JavaScript code of shared bookmark, JavaScript executes in the admin’s browser, retrieves the CSRF token, and sends a request to change the admin's password resulting in a full account takeover.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14202.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "Gridware"
}

References

Affected packages

Git / github.com/sissbruecker/linkding

Affected ranges

Type

GIT

Repo

https://github.com/sissbruecker/linkding

Events

Introduced

344420ec4ac5c2763beca24c443e2dddf5b7e387

Last affected

344420ec4ac5c2763beca24c443e2dddf5b7e387

Database specific

{
    "extracted_events": [
        {
            "introduced": "1.44.1"
        },
        {
            "last_affected": "1.44.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.44.1

v1.*

v1.44.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-14202.json"