CVE-2025-14202: Cross-Site Request Forgery (CSRF) Leading to Account Takeover via SVG File Upload

Severity: high (CVSS 8.2 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-18 · updated 2026-10-13
Weakness: CWE-79

Description

A vulnerability in the file upload at bookmark + asset rendering pipeline allows an attacker to upload a malicious SVG file with JavaScript content. When an authenticated admin user views the SVG file with embedded JavaScript code of shared bookmark, JavaScript executes in the admin’s browser, retrieves the CSRF token, and sends a request to change the admin's password resulting in a full account takeover.

Affected products

LinkDing: 1.44.1

References

https://www.cve.org/cverecord?id=CVE-2025-14202

Get alerted when CVE-2025-14202 or the next vulnerability affects your stack