CVE-2025-13488: Repository Upload XSS Vulnerability

CVE-2025-13488 Overview

CVE-2025-13488 is a stored cross-site scripting (XSS) vulnerability in Sonatype Nexus Repository. A regression introduced in version 3.83.0 removed a security response header from certain user-uploaded content served from repositories. An authenticated attacker with repository upload privileges can upload content that executes JavaScript in the browser context of other users who access the file. The weakness is categorized under CWE-79. Sonatype addressed the issue in Nexus Repository 3.87.0.

Critical Impact
Authenticated users with upload rights can plant stored XSS payloads in repository artifacts, enabling session theft, credential capture, or forced actions against other Nexus users.

Affected Products

Sonatype Nexus Repository 3.83.0 and later releases prior to 3.87.0
Deployments serving user-uploaded content from affected repositories
Both OSS and Pro editions within the affected version range

Discovery Timeline

2025-12-04 - CVE-2025-13488 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13488

Vulnerability Analysis

The flaw is a stored XSS condition rooted in missing output hardening on repository-served files. Before version 3.83.0, Nexus Repository applied a security response header that constrained how browsers rendered user-uploaded content. The 3.83.0 release regressed this behavior and no longer attached the header to certain response paths. As a result, HTML, SVG, or script-bearing payloads uploaded to a repository can execute in the browser session of any user that fetches them directly.

Exploitation requires authentication and upload permissions on at least one repository. The payload runs in the user context of whoever retrieves the artifact, inheriting that user's Nexus session cookies and privileges. Successful execution can lead to session hijacking, API token theft, or coerced administrative actions against the Nexus instance.

Root Cause

The root cause is a regression in the HTTP response handling logic for user-controlled content. A security header (consistent with Content-Security-Policy or X-Content-Type-Options style controls) that forced safe rendering of uploaded files was no longer emitted for certain content paths. Without that header, browsers interpret and execute active content inline rather than treating it as inert data.

Attack Vector

The attack vector is network-based and requires low privileges plus user interaction. An attacker with repository write access uploads a crafted artifact containing JavaScript. When a victim with a Nexus session browses or downloads the artifact through the web UI or a direct URL, the browser executes the embedded script under the Nexus origin. See the Sonatype Support Article for vendor details.

Detection Methods for CVE-2025-13488

Indicators of Compromise

Repository artifacts with HTML, SVG, or JavaScript MIME types uploaded by non-administrative accounts
Unexpected <script>, onerror, or onload attributes in files residing in raw, Maven, or similar repositories
Nexus audit log entries showing uploads by users immediately followed by access from administrator accounts
Browser console errors or unexpected outbound requests from the Nexus web origin

Detection Strategies

Scan existing repository content for files containing executable HTML or script tags, prioritizing uploads after the 3.83.0 upgrade
Review Nexus access logs for direct GET requests to user-uploaded files with text/html or image/svg+xml response types
Correlate upload events with subsequent authenticated sessions originating from new IP addresses or user agents

Monitoring Recommendations

Enable and forward Nexus audit and request logs to a centralized SIEM for retention and query
Alert on administrative account activity shortly after artifact uploads by lower-privileged users
Monitor browser-side telemetry for anomalous script execution on the Nexus domain

How to Mitigate CVE-2025-13488

Immediate Actions Required

Upgrade Sonatype Nexus Repository to version 3.87.0 or later, which restores the missing security header
Audit the users and roles that hold repository upload privileges and remove unnecessary grants
Review repositories for suspicious HTML, SVG, or script-bearing artifacts uploaded since the 3.83.0 release

Patch Information

Sonatype resolved the regression in Nexus Repository 3.87.0. Details are published in the Sonatype Nexus Release Notes. Administrators running any version between 3.83.0 and 3.86.x should plan an upgrade and verify that the fix is applied before restoring normal upload workflows.

Workarounds

Restrict upload permissions to trusted service accounts until the upgrade is applied
Place Nexus behind a reverse proxy that injects a strict Content-Security-Policy for responses from repository paths
Serve user-uploaded content from a separate origin or subdomain to isolate it from authenticated Nexus sessions

bash

# Example reverse proxy header injection (nginx)
location /repository/ {
    proxy_pass http://nexus_backend;
    add_header Content-Security-Policy "default-src 'none'; sandbox" always;
    add_header X-Content-Type-Options "nosniff" always;
}