CVE-2025-70365 Kiamo CVE debrief

Who should care

Users of Kiamo before version 8.4 should apply the fix to prevent exploitation of this stored cross-site scripting (XSS) vulnerability. This includes administrators and security teams responsible for managing Kiamo installations. The vulnerability requires administrative access to exploit but can have significant impacts if exploited. Security teams should prioritize patching and monitor for suspicious activity.

Technical summary

The vulnerability exists due to improper output encoding of user-supplied input in administrative interfaces of Kiamo before 8.4. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected pages. This issue requires administrative access to exploit, increasing the difficulty but not eliminating the risk. The CVSS score of 5.4 reflects the Medium severity of this vulnerability.

Defensive priority

Medium-High priority given the CVSS score of 5.4, the requirement for administrative access to exploit, and the potential impact of successful exploitation.

Recommended defensive actions

• Apply the fix from the vendor for Kiamo version 8.4 or later.
• Inventory and update affected Kiamo installations.
• Monitor administrative interfaces for suspicious activity.
• Implement compensating controls such as web application firewalls.
• Restrict administrative access to trusted users.

Evidence notes

The CVE record was published on 2026-04-09T16:16:25.707Z and last modified on 2026-07-05T02:17:38.950Z. The Supplier claims a fix was already released for the 8.3.1 branch before the CVE Record was published. Evidence is limited to CVE and NVD details. Defenders should verify Kiamo versions, check for administrative interface exposure, and monitor for suspicious JavaScript activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.