Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-63830 — Identified a Stored Cross-Site Scripting (XSS) vulnerability in CKFinder v1.4.3 via malicious SVG file upload leading to script execution upon file preview. | Kitploit
Tools/GitHubGitHub/shubham03007/cve-2025-63830
Vulnerability AnalysisWeb Application ExploitationWeb SecurityPapers & ResearchLearning & Education
GitHubshubham03007/cve-2025-63830

CVE-2025-63830

Identified a Stored Cross-Site Scripting (XSS) vulnerability in CKFinder v1.4.3 via malicious SVG file upload leading to script execution upon file preview.

View Repository
110 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

📂 CKFinder 1.4.3 – Stored Cross-Site Scripting (XSS) via Malicious SVG Upload

CVE ID: CVE-2025-63830

🧭 Overview

A stored Cross-Site Scripting (XSS) vulnerability was identified in CKFinder v1.4.3.
The issue resides in the file upload functionality, which fails to properly sanitize SVG files containing active content.
As a result, an attacker can execute arbitrary JavaScript code in the context of the victim’s browser when the uploaded file is viewed or previewed.

⚙️ Details

  • Finding Name: Stored Cross-Site Scripting (XSS) via Malicious SVG Upload
  • Severity: High
  • CVE ID: CVE-2025-63830
  • Affected Component: File Upload Function
  • Affected Product: CKFinder v1.4.3
  • Vendor: CKSource Holding sp. z o.o.
  • Attack Type: Remote

🧾 Description

CKFinder v1.4.3 is vulnerable to Stored Cross-Site Scripting (XSS) in its File Upload functionality.
Uploading a crafted SVG file containing JavaScript code results in persistent script execution when the file is later accessed or previewed in the application.

This occurs because the SVG file is stored and served as-is, allowing embedded tags, event handlers (e.g., , ), or elements to execute in the application's origin context.

<script>
onload
onclick
<foreignObject>

🧪 Steps to Reproduce

  1. Log in to the application integrated with CKFinder v1.4.3.
  2. Navigate to the File Upload feature.
  3. Upload the following malicious SVG file:
  4. After upload, access or preview the file from within the CKFinder file manager or any linked view.
  5. Observe JavaScript execution in the browser.

🎯 Impact / Risks

  • Execution of arbitrary JavaScript in the victim’s browser.
  • Theft of session tokens or sensitive information.
  • DOM manipulation or redirection to malicious websites.
  • Potential lateral movement within admin or management interfaces.

🛡️ Remediation

  • Sanitize and validate uploaded SVG files before storing or rendering.
  • Disable SVG uploads if not required.
  • If SVG uploads are necessary:
    • Use a secure SVG sanitizer (e.g., DOMPurify, SVG-Sanitizer) before rendering.
    • Serve uploaded SVGs with secure response headers:
      root@kitploit:~
      Content-Type: image/svg+xml; charset=UTF-8
Content-Disposition: attachment
X-Content-Type-Options: nosniff
    • Host user-uploaded files on a separate domain or CDN to enforce origin isolation.
  • Upgrade to the latest version of CKFinder, as newer versions may include improved file sanitization and security handling.

Proof-Of-Concept

image (11)
image (12)
image (13)
image (14)
image (15)

👤 Discoverer

Shubham Ghadge
Security Researcher / Application Security Consultant

Download Tool