CVE-2025-3801

Analysis

A stored cross-site scripting (XSS) vulnerability exists in the songquanpeng one-api application up to version 0.6.10. The flaw resides in the System Setting Handler component, where user input supplied to the 'Homepage Content', 'About System', and 'Footer' arguments is not properly sanitized before being stored and later rendered in the administrative interface [1][2]. This allows an attacker to inject arbitrary JavaScript or HTML into these fields.

To exploit this vulnerability, an attacker must first authenticate as a user with privileges to modify system settings [3]. Once authenticated, the attacker can navigate to the affected settings pages and insert malicious payloads, such as `` into the Homepage Content field [3]. The injected script is then stored on the server and executed in the browsers of other users who visit the impacted pages.

The impact of successful exploitation is limited due to the low CVSS base score (2.4) and the requirement for authenticated access with elevated privileges. An attacker could potentially deface the application interface, steal session cookies, or perform actions on behalf of other users who view the compromised pages. The vulnerability is classified as problematic and has a publicly available proof-of-concept [3].

Mitigation

As of the publication date, version 0.6.10 and earlier are affected. Users should monitor the official GitHub repository [1] for a patched release. No workaround is documented in the references, so administrators should apply input sanitization to these settings fields or restrict modification privileges to trusted users only.