Unrated severityNVD Advisory· Published Oct 17, 2025· Updated Nov 19, 2025
ThingsBoard < v4.2.1 SVG Image SSRF
CVE-2025-34282
Description
ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may initiate unintended outbound requests. This can be used to access internal services or resources.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<4.2.1+ 1 more
- (no CPE)range: <4.2.1
- (no CPE)range: 0
Patches
Vulnerability mechanics
References
3- github.com/thingsboard/thingsboard/pull/13927mitrepatch
- github.com/thingsboard/thingsboard/releases/tag/v4.2.1mitrerelease-notespatch
- www.vulncheck.com/advisories/thingsboard-svg-image-ssrfmitrethird-party-advisory
News mentions
0No linked articles in our index yet.