CVE-2025-2194: MRCMS XSS Vulnerability in FileController

CVE-2025-2194 Overview

CVE-2025-2194 is a cross-site scripting (XSS) vulnerability in MRCMS 3.1.2, an open-source content management system. The flaw resides in the list function of the /admin/file/list.do endpoint within the org.marker.mushroom.controller.FileController component. Attackers can manipulate the path argument to inject arbitrary script content, which the application renders without proper output encoding [CWE-79]. The issue requires authenticated low-privilege access and user interaction to trigger. Public disclosure includes technical details, and the vendor did not respond to disclosure attempts. Exploitation impacts session integrity of administrators interacting with the affected file management interface.

Critical Impact
Authenticated attackers can inject persistent JavaScript payloads through the file listing endpoint, enabling session hijacking, credential theft, and administrative action forgery against MRCMS administrators.

Affected Products

MRCMS 3.1.2
org.marker.mushroom.controller.FileController component
/admin/file/list.do endpoint

Discovery Timeline

2025-03-11 - CVE-2025-2194 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2194

Vulnerability Analysis

The vulnerability affects MRCMS 3.1.2, a Java-based content management platform. The list function inside FileController accepts a user-controlled path parameter through the /admin/file/list.do endpoint. The application reflects or persists this parameter into HTML output without applying context-aware encoding or sanitization.

An authenticated attacker with low privileges can supply a crafted path value containing JavaScript. When an administrator or another user loads the file listing page, the browser executes the injected script in the origin of the MRCMS application. This produces standard XSS impact within the administrative interface.

The disclosure notes that the vendor did not respond to notification. No official patch or vendor advisory currently exists for MRCMS 3.1.2.

Root Cause

The root cause is missing output encoding on the path request parameter before it is written into the file management view. The FileController.list method trusts client-supplied input and passes it directly into HTML context, violating the neutralization requirement described in CWE-79.

Attack Vector

Exploitation occurs over the network against an authenticated MRCMS admin session. The attacker crafts a URL or form submission targeting /admin/file/list.do with a malicious path value. Delivery relies on user interaction, such as an administrator opening a crafted link or navigating to a poisoned listing.

The injected script executes in the administrator's browser under the MRCMS origin. Attackers can steal session cookies, perform administrative actions through forged requests, or pivot to further compromise of hosted content.

No working exploit code has been verified in public sources beyond the disclosure. Technical background is available in the GitHub Issue Discussion and the VulDB CVE Analysis.

Detection Methods for CVE-2025-2194

Indicators of Compromise

Requests to /admin/file/list.do containing HTML or JavaScript metacharacters such as <script>, onerror=, javascript:, or encoded variants in the path parameter.
Unusual outbound requests from administrator browsers to attacker-controlled domains shortly after visiting the MRCMS admin panel.
Administrative sessions or API tokens used from unexpected source IP addresses following interaction with file listing pages.

Detection Strategies

Inspect web server and application access logs for path parameter values containing angle brackets, event handlers, or URL-encoded script payloads targeting /admin/file/list.do.
Deploy web application firewall (WAF) rules that flag reflected XSS patterns on MRCMS administrative endpoints.
Correlate administrator authentication events with subsequent anomalous privileged operations to identify session abuse.

Monitoring Recommendations

Enable verbose logging of the FileController request parameters and archive logs for retrospective analysis.
Monitor Content Security Policy (CSP) violation reports if CSP is deployed in the admin console.
Track browser telemetry from workstations that access MRCMS admin functions for unexpected script execution or DOM changes.

How to Mitigate CVE-2025-2194

Immediate Actions Required

Restrict access to the MRCMS /admin/ path to trusted management networks or VPN-authenticated sessions.
Instruct administrators to avoid clicking unsolicited links that target the MRCMS admin console, particularly links referencing file/list.do.
Rotate administrative credentials and invalidate active sessions if suspicious path parameter values appear in logs.

Patch Information

No vendor patch is available. The disclosure states that the MRCMS maintainers did not respond to coordinated disclosure attempts. Organizations running MRCMS 3.1.2 should evaluate migration to an actively maintained CMS or apply the workarounds below until a fix is released. Track updates through the VulDB CVE Analysis.

Workarounds

Place a reverse proxy or WAF in front of MRCMS and block requests to /admin/file/list.do where the path parameter contains HTML control characters.
Apply a strict Content Security Policy on the admin interface that disallows inline scripts and restricts script sources to same-origin.
If source code modification is feasible, patch FileController.list to HTML-encode the path parameter before rendering, using a library such as OWASP Java Encoder.

bash

# Example nginx rule to block suspicious path parameters on the vulnerable endpoint
location = /admin/file/list.do {
    if ($arg_path ~* "(<|>|script|onerror|javascript:|%3C|%3E)") {
        return 403;
    }
    proxy_pass http://mrcms_backend;
}