Vulnerability · Published Sep 9, 2026 · Assigned by SCHUTZWERK
CVE-2025-7062Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education
Medium 5.2
In plain English
A medium-severity cross-site scripting in h5p-nodejs-library from Lumi Education UG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Official description
A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lumi Education UG | h5p-nodejs-library | 0 – before 10.0.4 |
Weakness: CWE-79, CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P