CVE-2025-49590: CryptPad Dom-Based Cross-Site Scripting (XSS) Vulnerability

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-06-18 · updated 2026-06-17
Weakness: CWE-692

Description

CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an "early allow" code path that happens before the URI's protocol/scheme is checked, which a maliciously crafted URI can follow. This issue has been patched in version 2025.3.0.

Affected products

cryptpad: before 2025.3.0 — fixed in 2025.3.0

How to fix

Upgrade to a fixed version: cryptpad 2025.3.0. Check the vendor advisory for mitigations.

References

https://github.com/cryptpad/cryptpad/blob/15c81aa8ccb737a9a1167481f4a699af331364bb/www/bounce/main.js#L64-L95
https://github.com/cryptpad/cryptpad/commit/d5e4830ba104a4a442cb23aab5378b8565a95607
https://github.com/cryptpad/cryptpad/security/advisories/GHSA-vq9h-x3gr-v8rj

Get alerted when CVE-2025-49590 or the next vulnerability affects your stack