Graylog Allows Stored Cross-Site Scripting via Files Plugin and API Browser
High7.3Published May 7, 2025 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.graylog2:graylog2-server Maven | < 6.2.0 | 6.2.0 |
Details and references
### Impact Two minor vulnerabilities were identified in the Graylog2 enterprise server, which can be combined to carry out a stored cross-site scripting attack. An attacker with the permission `FILES_CREATE` can exploit these vulnerabilities to upload arbitrary Javascript code to the Graylog2 server, which - upon requesting of the file by a user of the API browser - results in the execution of this Javascript code in the context of the Graylog frontend application. This enables the attacker to carry out authenticated API requests with the permissions of the logged-in user, thereby taking over the user session. ### Patches The generic API has been removed in 6.2.0 rendering the attack vector unreachable and additional escaping has been added. Analysis provided by Fabian Yamaguchi - Whirly Labs (Pty) Ltd
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
More graylog2-server advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 72025 | Graylog Allows Session Takeover via Insufficient HTML Sanitization CVE-2025-46827High8.0fixed in 6.0.14, 6.1.10 | High8.0 | 6.0.14, 6.1.10 |
| Apr 72025 | Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value CVE-2025-30373Medium6.5fixed in 6.1.9 | Medium6.5 | 6.1.9 |
| Jun 302025 | Graylog vulnerable to privilege escalation through API tokens CVE-2025-53106Highfixed in 6.2.4, 6.3.0-rc.2 | High | 6.2.4, 6.3.0-rc.2 |
| Feb 72024 | Graylog session fixation vulnerability through cookie injection CVE-2024-24823Medium5.7fixed in 5.1.11, 5.2.4 | Medium5.7 | 5.1.11, 5.2.4 |
| Feb 72024 | Graylog vulnerable to instantiation of arbitrary classes triggered by API request CVE-2024-24824High8.8fixed in 5.1.11, 5.2.4 | High8.8 | 5.1.11, 5.2.4 |
| Aug 28 | Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields CVE-2026-55425Medium5.0fixed in 7.1.4 | Medium5.0 | 7.1.4 |