CVE-2025-2208: XSS in springboot-manager 3.0

The vulnerability allows an attacker to inject arbitrary JavaScript code into the application via manipulation of the 'name' parameter when uploading files to the /sysFiles/upload endpoint. Successful exploitation could lead to session hijacking, defacement of the application, or redirection to malicious websites. The attacker could potentially steal sensitive user data or gain unauthorized access to the system. This vulnerability is particularly concerning as it is a cross-site scripting flaw, which is a common attack vector used to compromise web applications.

1. Reserved2025-03-11
2. Published2025-03-11
3. EPSS updated2026-04-02

The primary mitigation is to upgrade to version 3.0.1 of springboot-manager, which addresses the vulnerability. If an immediate upgrade is not feasible, consider implementing input validation and sanitization on the 'name' parameter within the /sysFiles/upload endpoint. A Web Application Firewall (WAF) can be configured to block requests containing suspicious characters or patterns in the filename. Regularly review and update security policies to prevent similar vulnerabilities in the future.