CVE-2025-7062

Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education

State: Published
Severity: 5.2 Medium
Published: Sep 9, 2026
Updated: Sep 22, 2026
Reserved: Jul 4, 2025

Description

A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.

Scores

CVSS	Score	Vector	Source
4.0	5.2 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P	SCHUTZWERK

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
CWE-20 Improper Input Validation

Affected Products

Product	Versions
h5p-nodejs-libraryLumi Education UG	before 10.0.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.