CVE-2025-35996 KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
An authenticated attacker can inject malicious scripts via crafted filenames in KUNBUS Revolution Pi PiCtory, leading to cross-site scripting attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-35996?
CVE-2025-35996 is a high-severity cross-site scripting vulnerability in KUNBUS GmbH Revolution Pi PiCtory, published on 1 May 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API endpoints. That filename is later transmitted to the client in order to show a list of configuration files. Due to a missing escape or sanitization, the filename could be executed as HTML script tag resulting in a cross-site-scripting attack.
Weakness: CWE-97
Which versions are affected by CVE-2025-35996?
How do I fix CVE-2025-35996?
No fix has been published for CVE-2025-35996 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-35996 being exploited?
There is no known exploitation of CVE-2025-35996 in the wild and no public exploit code.
Sources
Also known as GHSA-v2xg-gxf7-x426.