Vulnerability · Published Oct 17, 2025 · Assigned by VulnCheck

CVE-2025-34282ThingsBoard < v4.2.1 SVG Image SSRF

Medium 6.9

In plain English

A medium-severity server-side request forgery in ThingsBoard from ThingsBoard, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)1.8%top 21.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may initiate unintended outbound requests. This can be used to access internal services or resources.

Affected products (as reported)

Vendor	Product	Versions
ThingsBoard, Inc.	ThingsBoard	0 – before 4.2.1

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

References

https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1 release-notes, patch
https://github.com/thingsboard/thingsboard/pull/13927 issue-tracking
https://www.vulncheck.com/advisories/thingsboard-svg-image-ssrf third-party-advisory