CVE-2025-57292: Doist Todoist

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The application fails to properly validate the MIME type and sanitize image metadata.

Affected products

• Doist Todoist: version 8484 only

Published 2025-09-26. Last modified 2026-06-17.