Is org.thingsboard:application affected by CVE-2025-3261?

Maven org.thingsboard:application is affected in <4.2.1.

Is CVE-2025-3261 being exploited?

Not on the CISA KEV list. EPSS exploit probability is not available.

medium

CVE-2025-3261

Q: Is CVE-2025-3261 being exploited?

Not on the CISA KEV list. EPSS exploit probability is not available.

Maven · org.thingsboard:application

Summary

ThingsBoard allows an authenticated user to upload malicious SVG images

Severity: medium
Also known as: GHSA-5p82-2q3r-wj3m
Published: 2025-11-27

References

https://nvd.nist.gov/vuln/detail/CVE-2025-3261
https://github.com/thingsboard/thingsboard/commit/b2ae6f92d12206ea185a2e882945a6b69234bf03
https://advisory.checkmarx.net/advisory/CVE-2025-3261

Related advisories

CVE-2025-34281 — medium · Maven/org.thingsboard:application

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.