CVE-2025-53839: DRACOON Branding Service vulnerable to Cross-site Scripting

Severity: medium (CVSS 4.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-15 · updated 2026-06-17
Weakness: CWE-79

Description

DRACOON is a file sharing service, and the DRACOON Branding Service allows customers to customize their DRACOON interface with their brand. Versions of the DRACOON Branding Service prior to 2.10.0 are vulnerable to cross-site scripting. Improper neutralization of input from administrative users could inject HTML code into the workflow for newly onboarded users. A fix was made available in version 2.10.0 and rolled out to the DRACOON service. DRACOON customers do not need to take action.

Affected products

dracoon security-advisories: before 2.10.0

References

https://github.com/dracoon/security-advisories/security/advisories/GHSA-jv2h-8mw7-mc97

Get alerted when CVE-2025-53839 or the next vulnerability affects your stack