CVE-2025-1983

A cross-site scripting (XSS) vulnerability in Ready_'s File Explorer upload functionality allows injection of arbitrary JavaScript code in filename. Injected content is stored on server and is executed every time a user interacts with the uploaded file.

Score

CVSS 4.0 5.1 Medium

Status

Deferred - cvd@cert.pl

Published

2025-04-16

Last modified

2025-04-16

Weaknesses

CWE-79

Affected products

• Ready (Symfonia)

References

• https://cert.pl/en/posts/2025/04/CVE-2025-1980
• https://cert.pl/posts/2025/04/CVE-2025-1980
• https://ready-os.com/pl/