CVE-2025-34282: ThingsBoard < v4.2.1 SVG Image SSRF

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-10-17 · updated 2026-10-23
Weakness: CWE-918

Description

ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may initiate unintended outbound requests. This can be used to access internal services or resources.

Affected products

ThingsBoard: before 4.2.1 — fixed in 4.2.1

How to fix

Upgrade to a fixed version: ThingsBoard 4.2.1. Check the vendor advisory for mitigations.

References

https://github.com/thingsboard/thingsboard/pull/13927
https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1
https://www.vulncheck.com/advisories/thingsboard-svg-image-ssrf

Get alerted when CVE-2025-34282 or the next vulnerability affects your stack