Stored XSS Vulnerability in Homarr Open-Source Dashboard

CVE-2025-64759

What is CVE-2025-64759?

Homarr, an open-source dashboard, is vulnerable to stored XSS due to the improper handling of uploaded SVG files. Prior to version 1.43.3, this vulnerability enabled the execution of arbitrary JavaScript in a user's browser with little to no user interaction. An attacker could exploit this by uploading a malicious SVG file, which when viewed by an administrator, could potentially elevate their privileges to gain full administrative access. This has significant implications for the security of the platform, particularly for users with administrative rights. The issue has been remediated in version 1.43.3, so users are urged to update to this version or later to mitigate any risks.

References