CVE-2025-55944

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-09-03 · updated 2026-06-17
Weakness: CWE-79

Description

Slink v1.4.9 allows stored cross-site scripting (XSS) via crafted SVG uploads. When a user views the shared image in a new browser tab, the embedded JavaScript executes. The issue affects both authenticated and unauthenticated users.

Affected products

Slinkapp Slink: 1.4.9, 1.5.1, 1.6.3

References

https://github.com/G3XAR/Vulnerability-Research/tree/main/CVE-2025-55944
https://github.com/G3XAR/Vulnerability-Research/tree/main/Slink%20%28up%20to%201.6.3%29/PoC

Get alerted when CVE-2025-55944 or the next vulnerability affects your stack