Vulnerability · Published Jul 14, 2025 · Assigned by GitHub_M

CVE-2025-53839DRACOON Branding Service vulnerable to Cross-site Scripting

Medium 4.0

In plain English

A medium-severity cross-site scripting in security-advisories from dracoon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)4.0Medium

Exploit odds (30 days)0.2%top 87.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

DRACOON is a file sharing service, and the DRACOON Branding Service allows customers to customize their DRACOON interface with their brand. Versions of the DRACOON Branding Service prior to 2.10.0 are vulnerable to cross-site scripting. Improper neutralization of input from administrative users could inject HTML code into the workflow for newly onboarded users. A fix was made available in version 2.10.0 and rolled out to the DRACOON service. DRACOON customers do not need to take action.

Affected products (as reported)

Vendor	Product	Versions
dracoon	security-advisories	< 2.10.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/dracoon/security-advisories/security/advisories/GHSA-jv2h-8mw7-mc97 x_refsource_CONFIRM