CVE-2025-1076: Holded Application Stored XSS Vulnerability

CVE-2025-1076 Overview

CVE-2025-1076 is a Stored Cross-Site Scripting (Stored XSS) vulnerability affecting the Holded application. Attackers can inject JavaScript payloads through the editable name and icon parameters within the Activities functionality. The injected script is persisted server-side and executes in the browser context of any user who subsequently views the affected content.

The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. Exploitation requires high privileges and user interaction, limiting the population of viable attackers.

Critical Impact
An authenticated attacker with high privileges can persist arbitrary JavaScript that executes in the sessions of other Holded users, enabling session-context actions, UI manipulation, and data exfiltration through the compromised browser.

Affected Products

Holded application (business management SaaS platform)
Activities functionality accepting name parameter input
Activities functionality accepting icon parameter input

Discovery Timeline

2025-02-06 - CVE-2025-1076 published to the National Vulnerability Database
2026-06-17 - CVE-2025-1076 last updated in NVD database

Technical Details for CVE-2025-1076

Vulnerability Analysis

The Holded application fails to properly neutralize user-controlled input submitted to the Activities feature. Specifically, the name and icon fields accept arbitrary content, including HTML and JavaScript, without adequate sanitization or output encoding. Because the payload is stored server-side and re-rendered when other users load the Activities view, this is a persistent (stored) XSS rather than a reflected variant.

Exploitation requires an authenticated account with elevated privileges to submit the malicious Activity entry. A victim must then interact with the affected view for the payload to execute. When it fires, the script runs in the origin context of the Holded application, granting access to the Document Object Model, cookies not marked HttpOnly, and application APIs available to the victim.

Because the CVSS vector reflects a scope change, the injected script can affect resources beyond the vulnerable component itself, such as parent frames or adjacent application surfaces sharing the browser session.

Root Cause

The root cause is missing input validation and output encoding on the name and icon parameters in the Activities module. The application accepts characters used to construct HTML tags and script blocks, then renders them without contextual escaping suitable for HTML, attribute, or JavaScript sinks.

Attack Vector

The attack is network-based over HTTPS through the standard Holded web interface. An authenticated attacker submits an Activity containing a JavaScript payload embedded in the name or icon field. The payload persists in application storage. When any other user, including administrators, navigates to the Activities view, the browser parses the stored input and executes the attacker-controlled script.

Refer to the INCIBE notice on the stored XSS vulnerability in Holded for the coordinating advisory.

Detection Methods for CVE-2025-1076

Indicators of Compromise

Activity entries whose name or icon fields contain HTML tags such as <script>, <img>, <svg>, or event handler attributes like onerror= and onload=.
Outbound browser requests from authenticated Holded sessions to domains not associated with Holded infrastructure.
Unexpected DOM modifications or JavaScript errors reported by users viewing the Activities module.

Detection Strategies

Review application audit logs for Activity create and update events, correlating actor identity with payload content stored in name and icon.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script executions that would violate a stricter policy.
Query stored Activity records for characters and substrings commonly used in XSS payloads, such as angle brackets, javascript:, and encoded variants.

Monitoring Recommendations

Monitor administrative and privileged account activity within Holded for unusual Activity submissions, particularly from newly provisioned users.
Alert on browser console errors and CSP violation reports originating from the Holded origin.
Track outbound network telemetry from workstations for connections to unknown hosts immediately following Holded session activity.

How to Mitigate CVE-2025-1076

Immediate Actions Required

Contact Holded support to confirm whether a fixed version or server-side remediation has been applied to your tenant.
Audit existing Activity records for suspicious payloads in the name and icon fields and remove any injected content.
Restrict the assignment of privileged roles that can create or modify Activities to a minimum set of trusted users.
Enforce multi-factor authentication on all Holded accounts to reduce the risk of credential compromise leading to payload injection.

Patch Information

No vendor patch reference is listed in the NVD entry for CVE-2025-1076. The coordinating advisory is published by INCIBE-CERT. Holded customers should engage the vendor directly to confirm the remediation status for their environment.

Workarounds

Apply strict role-based access control so only vetted users can create or edit Activities.
Configure browser-side defenses such as a strong Content Security Policy at any reverse proxy or wrapper you control.
Educate privileged users to avoid interacting with Activity entries created by unfamiliar accounts until the vendor confirms a fix.

bash

# Example Content Security Policy header to reduce inline script execution risk
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report