Vulnerability-Lookup

CVE-2025-7062 (GCVE-0-2025-7062)

Vulnerability from cvelistv5 – Published: 2026-09-09 06:14 – Updated: 2026-09-09 20:51

Title

Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education

Summary

A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.

Severity

5.2 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 20:30 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
CWE-20 - Improper Input Validation

Assigner

SCHUTZWERK mitre root

References

2 references

URL	Tags
https://www.schutzwerk.com/en/blog/schutzwerk-sa-…
https://github.com/Lumieducation/H5P-Nodejs-libra…	patch

Impacted products

1 product

Vendor	Product	Version	CPE status
Lumi Education UG	h5p-nodejs-library	Affected: 0 , < 10.0.4 (custom)	guessed

Date Public

2026-09-09 06:00

Credits

Florian Schmid of SCHUTZWERK GmbH

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-7062",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T20:30:55.655255Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T20:51:32.652Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "Import of H5P modules"
          ],
          "packageName": "h5p-nodejs-library",
          "product": "h5p-nodejs-library",
          "programFiles": [
            "packages/h5p-server/src/H5PEditor.ts"
          ],
          "repo": "https://github.com/Lumieducation/H5P-Nodejs-library",
          "vendor": "Lumi Education UG",
          "versions": [
            {
              "lessThan": "10.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Florian Schmid of SCHUTZWERK GmbH"
        }
      ],
      "datePublic": "2026-09-09T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eA stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.\u003cbr\u003e\u003cbr\u003e\u003c/div\u003e"
            }
          ],
          "value": "A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        },
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T06:14:22.143Z",
        "orgId": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423",
        "shortName": "SCHUTZWERK"
      },
      "references": [
        {
          "url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cspan\u003e\u003cspan\u003eAt the time of publication, no release fully prevents the upload and execution of files that contain JavaScript. Version 10.0.4 removes the SVG file extension from the default content allowlist, but it still identifies permitted files by their filename extension alone. An attacker can therefore upload a file with malicious JavaScript content under an allowed extension, such as XML, and have it executed.\u003c/span\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003e\u003cspan\u003eUntil a complete fix is available, operators should not rely on extension-based filtering alone. Uploaded files should be va\u003c/span\u003eli\u003cspan\u003ed\u003c/span\u003eat\u003cspan\u003eed and sanitized based on their actual content rather than their filename. For SVG uploads specifically, the library\u0027s \u003c/span\u003e\u003cspan\u003e\u003cspan\u003e[\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003eSVG file sanitization\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003e](\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003ehttps://github.com/Lumieducation/H5P-Nodejs-library/blob/v10.0.4/docs/packages/h5p-svg-sanitizer.md\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003e)\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e can be enabled, which\u003c/span\u003e uses \u003cspan\u003eDOMPurify to remove malicious script content from uploaded file\u003c/span\u003es.\u003c/span\u003e\u003c/div\u003e"
            }
          ],
          "value": "At the time of publication, no release fully prevents the upload and execution of files that contain JavaScript. Version 10.0.4 removes the SVG file extension from the default content allowlist, but it still identifies permitted files by their filename extension alone. An attacker can therefore upload a file with malicious JavaScript content under an allowed extension, such as XML, and have it executed.\n\n\n\n\nUntil a complete fix is available, operators should not rely on extension-based filtering alone. Uploaded files should be validated and sanitized based on their actual content rather than their filename. For SVG uploads specifically, the library\u0027s [SVG file sanitization](https://github.com/Lumieducation/H5P-Nodejs-library/blob/v10.0.4/docs/packages/h5p-svg-sanitizer.md) can be enabled, which uses DOMPurify to remove malicious script content from uploaded files."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-10-23T10:33:00.000Z",
          "value": "Vulnerability discovered"
        },
        {
          "lang": "en",
          "time": "2024-11-08T09:04:00.000Z",
          "value": "Initial contact attempt, email sent to c@lumi.education"
        },
        {
          "lang": "en",
          "time": "2024-11-20T23:00:00.000Z",
          "value": "Second contact attempt via a message on https://app.lumi.education/"
        },
        {
          "lang": "en",
          "time": "2024-11-28T23:00:00.000Z",
          "value": "Third contact attempt via a message in the Lumi Slack channel"
        },
        {
          "lang": "en",
          "time": "2025-02-25T23:00:00.000Z",
          "value": "First exchange between Lumi and the team of developers who use the H5P framework in their project"
        },
        {
          "lang": "en",
          "time": "2025-03-07T23:00:00.000Z",
          "value": "Release of h5p-nodejs-library v10.0.4 (https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4), which introduces an interface for file content sanitizers and an allowlist of file types permitted in H5P modules based on their filename extension. The SVG file extension is excluded."
        },
        {
          "lang": "en",
          "time": "2025-09-18T22:00:00.000Z",
          "value": "Identified that the allowlist approach does not prevent the upload of files with XSS content that is executed after loading"
        },
        {
          "lang": "en",
          "time": "2025-09-18T13:46:00.000Z",
          "value": "Sent email to security@lumi.education with an update on the finding and received a response the same day"
        },
        {
          "lang": "en",
          "time": "2025-09-18T15:00:00.000Z",
          "value": "Received a response from a developer working on Lumi Education"
        },
        {
          "lang": "en",
          "time": "2025-09-22T11:00:00.000Z",
          "value": "Video call with a developer working on Lumi Education. Received a commitment that an updated version including a fix should be ready within a few weeks"
        },
        {
          "lang": "en",
          "time": "2025-09-23T19:21:00.000Z",
          "value": "Exchange with the developer on details of the fix"
        },
        {
          "lang": "en",
          "time": "2025-09-24T12:18:00.000Z",
          "value": "Exchange with the developer on details of the fix"
        },
        {
          "lang": "en",
          "time": "2025-10-20T08:32:00.000Z",
          "value": "Requested a status update on the patch from the developer. No response received."
        },
        {
          "lang": "en",
          "time": "2025-11-14T07:45:00.000Z",
          "value": "Requested a status update on the patch from the developer. No response received."
        },
        {
          "lang": "en",
          "time": "2025-11-20T16:17:00.000Z",
          "value": "Requested a status update on the patch from the developer. No response received."
        },
        {
          "lang": "en",
          "time": "2025-11-26T12:42:00.000Z",
          "value": "Informed the business contact about the current status and recommended measures for the framework developers to implement. Publication delayed for undisclosed reasons."
        },
        {
          "lang": "en",
          "time": "2026-09-09T10:00:00.000Z",
          "value": "Advisory released"
        }
      ],
      "title": "Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423",
    "assignerShortName": "SCHUTZWERK",
    "cveId": "CVE-2025-7062",
    "datePublished": "2026-09-09T06:14:22.143Z",
    "dateReserved": "2025-07-04T06:13:06.914Z",
    "dateUpdated": "2026-09-09T20:51:32.652Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-7062",
      "date": "2026-09-09",
      "epss": "0.00253",
      "percentile": "0.16752"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-7062\",\"sourceIdentifier\":\"23637b5d-af4c-4cf9-b8f6-deb7fd0f8423\",\"published\":\"2026-09-09T07:16:55.180\",\"lastModified\":\"2026-09-09T21:17:01.127\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.\"}],\"affected\":[{\"source\":\"23637b5d-af4c-4cf9-b8f6-deb7fd0f8423\",\"affectedData\":[{\"vendor\":\"Lumi Education UG\",\"product\":\"h5p-nodejs-library\",\"defaultStatus\":\"unknown\",\"packageName\":\"h5p-nodejs-library\",\"modules\":[\"Import of H5P modules\"],\"programFiles\":[\"packages/h5p-server/src/H5PEditor.ts\"],\"repo\":\"https://github.com/Lumieducation/H5P-Nodejs-library\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"10.0.4\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"23637b5d-af4c-4cf9-b8f6-deb7fd0f8423\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-09T20:30:55.655255Z\",\"id\":\"CVE-2025-7062\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"23637b5d-af4c-4cf9-b8f6-deb7fd0f8423\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"},{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4\",\"source\":\"23637b5d-af4c-4cf9-b8f6-deb7fd0f8423\"},{\"url\":\"https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/\",\"source\":\"23637b5d-af4c-4cf9-b8f6-deb7fd0f8423\"}]}}"
  }
}

FKIE_CVE-2025-7062

Vulnerability from fkie_nvd - Published: 2026-09-09 07:16 - Updated: 2026-09-09 21:17

Severity

5.2 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P

Summary

References

	URL	Tags
	23637b5d-af4c-4cf9-b8f6-deb7fd0f8423	https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4
	23637b5d-af4c-4cf9-b8f6-deb7fd0f8423	https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "Import of H5P modules"
          ],
          "packageName": "h5p-nodejs-library",
          "product": "h5p-nodejs-library",
          "programFiles": [
            "packages/h5p-server/src/H5PEditor.ts"
          ],
          "repo": "https://github.com/Lumieducation/H5P-Nodejs-library",
          "vendor": "Lumi Education UG",
          "versions": [
            {
              "lessThan": "10.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content."
    }
  ],
  "id": "CVE-2025-7062",
  "lastModified": "2026-09-09T21:17:01.127",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.2,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-7062",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-09T20:30:55.655255Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-09T07:16:55.180",
  "references": [
    {
      "source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423",
      "url": "https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4"
    },
    {
      "source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423",
      "url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/"
    }
  ],
  "sourceIdentifier": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423",
      "type": "Secondary"
    }
  ]
}

GHSA-9248-Q3FG-HQMH

Vulnerability from github – Published: 2026-09-09 09:32 – Updated: 2026-09-09 09:32

Details

A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.

Severity

5.2 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-7062"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-09T07:16:55Z",
    "severity": "MODERATE"
  },
  "details": "A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.",
  "id": "GHSA-9248-q3fg-hqmh",
  "modified": "2026-09-09T09:32:57Z",
  "published": "2026-09-09T09:32:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7062"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4"
    },
    {
      "type": "WEB",
      "url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2025-7062 (GCVE-0-2025-7062)

FKIE_CVE-2025-7062

GHSA-9248-Q3FG-HQMH

Tags

Sightings

Nomenclature