CVE-2025-49590 | BDVDB-2026-283162 Detail

Description#

CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an "early allow" code path that happens before the URI's protocol/scheme is checked, which a maliciously crafted URI can follow. This issue has been patched in version 2025.3.0.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12025-06-18Record published in the CVE List.
2. Version 22025-06-23Most recent update recorded in the CVE List.