CVE-2025-27801

Vulnerability

Overview

CVE-2025-27801 is a stored cross-site scripting (XSS) vulnerability in the Optimizely Episerver Content Management System (CMS) affecting the media selection preview functionality. The root cause is that ContentReference properties used in the CMS 'Edit' section allow authenticated users to upload documents, including SVG files. The upload service does not sanitize or restrict SVG files, which can contain embedded JavaScript code [3].

Exploitation

Prerequisites

To exploit this vulnerability, an attacker must be authenticated with at least the 'WebEditor' role. The attacker uploads a crafted SVG file containing malicious JavaScript code to a ContentReference property. When any user (including administrators or editors) visits the direct URL to the preview image of that uploaded file, the embedded script executes in their browser context [1][2][3].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser. This can lead to session hijacking, defacement, or theft of sensitive information displayed in the CMS interface. The attack does not require any user interaction beyond viewing the preview URL, and the injected payload persists in the system until removed [3].

Mitigation

The vendor, Optimizely, has released patched packages. For version 11.x, update EPiServer.CMS.Core to at least 11.21.4 and EPiServer.CMS.UI to at least 11.37.5. For version 12.x, update EPiServer.CMS.Core to at least 12.22.1 and EPiServer.CMS.UI to at least 11.37.3 [1][2][3]. Organizations are strongly advised to apply these patches immediately.