CVE-2025-9094: ThingsBoard Add Gateway special elements used in a template engine

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-17 · updated 2026-06-17
Weakness: CWE-791

Description

A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor replies, that "[t]he fix will come within upcoming release (v4.2) and will be inherited by maintenance releases of LTS versions (starting 4.0)."

Affected products

ThingsBoard: 4.1

References

https://drive.google.com/file/d/1cZy-rfQXsF58kJIVs4UXj7usXJuhjZjA/view
https://vuldb.com/?ctiid.320416
https://vuldb.com/?id.320416
https://vuldb.com/?submit.626292

Get alerted when CVE-2025-9094 or the next vulnerability affects your stack