CVE-2025-7618 A stored Cross-Site Scripting (XSS) vulnerability exists in the File Explorer and Text Editor of ADM
Attackers can inject malicious scripts into ADM File Explorer and Text Editor to steal cookies and sensitive browser data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-7618?
CVE-2025-7618 is a medium-severity cross-site scripting vulnerability in ASUSTOR ADM, published on 14 Jul 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A stored Cross-Site Scripting (XSS) vulnerability vulnerability was found in the File Explorer and Text Editor of ADM. An attacker could exploit this vulnerability to inject malicious scripts into the applications, which may then access cookies or other sensitive information retained by the browser and used with the affected applications. Affected products and versions include: from ADM 4.1.0 to ADM 4.3.3.RH61 as well as ADM 5.0.0.RIN1 and earlier, and Text Editor 1.0.0.r112 and earlier.
Weakness: CWE-79
Which versions are affected by CVE-2025-7618?
How do I fix CVE-2025-7618?
No fix has been published for CVE-2025-7618 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-7618 being exploited?
There is no known exploitation of CVE-2025-7618 in the wild and no public exploit code.
Sources
Also known as GHSA-vcwx-v3cx-wrxp.