CVE-2025-30186

State: Published
Severity: 5.4 Medium
Published: Nov 27, 2025
Updated: Nov 28, 2025
Reserved: Mar 18, 2025

Description

Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N	OX

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
OX App SuiteOpen-Xchange GmbH	8.35.107 and earlierAffected 8.38.89 and earlierAffected 8.39.83 and earlierAffected 8.40.68 and earlierAffected 8.41.60 and earlierAffected

References

https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2025/oxas-adv-2025-0003.jsonvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.