CVE-2025-70849 Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS)
Unauthenticated attackers can upload arbitrary files to podinfo, leading to stored XSS and potential code execution due to missing content validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-70849?
CVE-2025-70849 is a medium-severity vulnerability in n/a, published on 3 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy (CSP) or adequate Content-Type validation, leading to Stored Cross-Site Scripting (XSS).
Which versions are affected by CVE-2025-70849?
3 open source packages ship an affected version, including github.com/stefanprodan/podinfo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/stefanprodan/podinfo Go | All versions | None |
github.com/stefanprodan/podinfo Go | All versions | 1.8.1-0.20260314125853-83deb7fcb742 |
github.com/stefanprodan/podinfo Go | All versions | 1.8.1-0.20260314125853-83deb7fcb742 |
Products include Stefanprodan Podinfo.
How do I fix CVE-2025-70849?
Upgrade github.com/stefanprodan/podinfo to 1.8.1-0.20260314125853-83deb7fcb742 or later.
Is CVE-2025-70849 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-70849 exists.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-mw8w-q3f7-2v85, GO-2026-4404.