VYPR
Get started
← All advisories
Moderate severityOSV Advisory· Published Nov 27, 2025· Updated Dec 16, 2025

CVE-2025-3261

CVE-2025-3261

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.thingsboard:applicationMaven
< 4.2.14.2.1

Affected products

1

Patches

1
b2ae6f92d122

added Content-Security-Policy header to download image api to prevent malicious code injection

https://github.com/thingsboard/thingsboarddashevchenkoAug 27, 2025via ghsa
commit
1 file changed · +1 −0
  • application/src/main/java/org/thingsboard/server/controller/ImageController.java+1 −0 modified
    @@ -300,6 +300,7 @@ private ResponseEntity<ByteArrayResource> downloadIfChanged(ImageCacheKey cacheK
         tbImageService.putETag(cacheKey, descriptor.getEtag());
         var result = ResponseEntity.ok()
                 .header("Content-Type", descriptor.getMediaType())
+                .header("Content-Security-Policy", "default-src 'none'")
                 .eTag(descriptor.getEtag());
         if (!cacheKey.isPublic()) {
             result

Vulnerability mechanics

Not enough inputs (no patches or CWE) to synthesize mechanics for this CVE.

References

4

News mentions

0

No linked articles in our index yet.