CVE-2025-65465

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-65465

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-65465.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-65465

Published

2026-03-02T00:00:00Z

Modified

2026-10-28T02:30:52Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R CVSS Calculator

Summary

[none]

Details

A reflected Cross-Site Scripting (XSS) vulnerability in the RaiseError function of Skrol29 TbsZip version 2.17 and earlier allows remote attackers to execute arbitrary web script or HTML via a crafted payload in a filename parameter (e.g., to the FileRead function). This occurs because the error message is not properly sanitized before being output to the user. This vulnerability is fixed in version 2.18.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65465.json"
}

References

Affected packages

Git / github.com/skrol29/tbszip

Affected ranges

Type

GIT

Repo

https://github.com/skrol29/tbszip

Events

Introduced

Fixed

8168765ddc16871feadcd2caef2ea3051a687b81

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.18"
                }
            ],
            "source": "DESCRIPTION"
        },
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "2.17"
                }
            ],
            "source": "DESCRIPTION"
        },
        {
            "original_tag": "v2.18",
            "range": [
                {
                    "fixed": "8168765ddc16871feadcd2caef2ea3051a687b81"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v2.*

v2.17

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-65465.json"