CVE-2018-25157 Phraseanet CVE debrief

Who should care

Defenders responsible for Phraseanet installations should assess exposure and prioritize remediation to prevent potential XSS attacks. This includes reviewing and verifying the affected versions, implementing input validation and sanitization, and monitoring for suspicious activity. Security teams and vulnerability management teams should also prioritize verifying and remediating this vulnerability to prevent potential XSS attacks.

Why it matters

CVE-2018-25157 is a stored XSS vulnerability in Phraseanet 4.0.3 that allows authenticated users to inject malicious scripts. Defenders should prioritize verifying and remediating this vulnerability to prevent potential XSS attacks.

• Potential cookie theft or user redirection
• Required verification of affected versions and remediation
• Needed input validation and sanitization implementation

Technical summary

The vulnerability allows authenticated users to inject malicious scripts through crafted file names during document uploads in Phraseanet 4.0.3. This can lead to potential cookie theft or user redirection when the file is viewed. The vulnerability has a CVSS score of 5.1 and a severity rating of MEDIUM. Defenders should prioritize verifying and remediating this vulnerability in their Phraseanet installations to prevent potential XSS attacks. The vulnerability is a stored XSS vulnerability that requires input validation and sanitization to prevent.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their Phraseanet installations to prevent potential XSS attacks.

Recommended defensive actions

• Verify Phraseanet version and check for updates
• Restrict document upload permissions
• Implement input validation and sanitization
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. The vulnerability is a stored XSS vulnerability in Phraseanet 4.0.3 that allows authenticated users to inject malicious scripts through crafted file names during document uploads. The CVE record was published on 2026-02-11T14:56:49.570Z and has not been modified since then. There are no known exploits or attacks in the wild, but defenders should prioritize verifying and remediating this vulnerability to prevent XSS.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.