CVE-2025-67438

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-20 · updated 2026-06-17
Weakness: CWE-79

Description

A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser. By uploading a crafted SVG file containing a malicious payload, an attacker can access and exfiltrate sensitive information, including the user's session cookies.

Affected products

Sync-in server: before 1.9.3 — fixed in 1.9.3

How to fix

Upgrade to a fixed version: Sync-in server 1.9.3. Check the vendor advisory for mitigations.

References

https://gist.github.com/x0root/86db30af91bb0e1707eb7e57a049b6ad
https://github.com/Sync-in/server/releases/tag/v1.9.3

Get alerted when CVE-2025-67438 or the next vulnerability affects your stack