{"id":"CVE-2025-34282","title":"ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature","summary":"ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes th…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-918"],"vendor":"thingsboard","product":"thingsboard","affected":["thingsboard < 4.2.1"],"patched":["thingsboard 4.2.1"],"published":"2025-10-17","updated":"2026-07-14","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-34282","references":[{"url":"https://github.com/thingsboard/thingsboard/pull/13927","label":"disclosure@vulncheck.com"},{"url":"https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/thingsboard-svg-image-ssrf","label":"disclosure@vulncheck.com"}],"tags":["nvd","exploit-available"],"epss":0.01818,"epssPercentile":0.77434,"exploitAvailable":true,"ingestedAt":"2026-07-15T13:44:03.244Z","exploits":{"exploitdb":true,"github":1,"githubRepos":["https://github.com/mathitam/thingsboard-ssrf-cve-2025-34282"],"checkedAt":"2026-09-21T15:27:21.725Z"},"slug":"CVE-2025-34282","body":"## Overview\n\nThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may initiate unintended outbound requests. This can be used to access internal services or resources.\n\n## Affected\n\n- `thingsboard < 4.2.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `thingsboard 4.2.1`","depth":"abyssal","depthScore":62,"depthScoreParts":{"impact":50.1,"likelihood":0.4,"exploitation":12,"ransomware":0},"changes":[]}