CVE-2018-25157: Phraseanet Dam Open Source

Medium severity, CVSS 6.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Phraseanet 4.0.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through crafted file names during document uploads. Attackers can upload files with embedded SVG scripts that execute in the browser, potentially stealing cookies or redirecting users when the file is viewed.

Affected products

• Phraseanet Phraseanet Dam Open Source: up to and including 4.0.3; version 4.0.4-dev only

Published 2026-02-11. Last modified 2026-10-08.