CVE-2025-2976: GFI Kerio Connect XSS Vulnerability

CVE-2025-2976 Overview

CVE-2025-2976 is a stored cross-site scripting (XSS) vulnerability affecting GFI KerioConnect version 10.0.6. The flaw resides in the File Upload component, where filenames containing JavaScript payloads are rendered back into the page without proper sanitization. An authenticated attacker can upload a file whose name embeds script content, which then executes in the browser of any user who views the affected input field. The issue is tracked under [CWE-79] and has been publicly disclosed with a proof of concept. The vendor was contacted but did not respond prior to disclosure.

Critical Impact
Attackers with low-privilege access can execute arbitrary JavaScript in the context of KerioConnect users, enabling session theft, phishing, and client-side action abuse.

Affected Products

GFI KerioConnect 10.0.6
Component: File Upload functionality
CPE: cpe:2.3:a:gfi:kerio_connect:10.0.6:-:*:*:*:*:*:*

Discovery Timeline

2025-03-31 - CVE-2025-2976 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2976

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the file upload workflow of GFI KerioConnect 10.0.6. When a user uploads a file, the application displays the filename inside an input field on the resulting page. The filename value is not sanitized or encoded before rendering, so HTML and JavaScript characters embedded in the filename are interpreted by the browser. An attacker needs valid low-privileged credentials and must trick a victim into viewing the page containing the attacker-controlled filename, satisfying the user interaction requirement.

Exploitation delivers client-side script execution in the context of the KerioConnect web interface. This enables cookie theft, forged requests on behalf of the victim, UI redressing, and credential harvesting through injected forms. The vulnerability has a limited integrity impact and no direct confidentiality or availability impact to the server component itself.

Root Cause

The root cause is missing output encoding of user-controlled filename data before it is reflected into the HTML response. The server stores the attacker-supplied filename verbatim and inserts it into an input element value attribute without applying HTML entity encoding or attribute-context escaping, violating the standard neutralization requirements described in [CWE-79].

Attack Vector

The attack is network-based and requires an authenticated session with upload privileges. An attacker crafts a file whose name contains an HTML or JavaScript payload, uploads it through the KerioConnect interface, and waits for another user to open the page where the filename is rendered. See the public GitHub proof of concept for the published demonstration of the technique.

Detection Methods for CVE-2025-2976

Indicators of Compromise

Uploaded files whose names contain HTML tag characters such as <, >, ", or script keywords.
Web server access logs showing multipart upload requests to KerioConnect with suspicious filename= parameters in Content-Disposition headers.
Browser console errors or unexpected outbound requests from client sessions after viewing file listings.

Detection Strategies

Inspect KerioConnect application logs for file upload events referencing filenames containing script tags, event handlers (onerror, onload), or JavaScript URI schemes.
Deploy a web application firewall (WAF) rule to flag or block uploads where the filename field contains HTML control characters.
Correlate upload events with subsequent anomalous session activity, such as mail-rule changes or password resets originating from the same session.

Monitoring Recommendations

Enable verbose logging on the KerioConnect web component to capture full filename metadata on upload.
Alert on cross-user access patterns where multiple accounts render the same uploaded resource soon after upload.
Monitor browser-side telemetry or Content Security Policy (CSP) violation reports for script execution from the KerioConnect origin.

How to Mitigate CVE-2025-2976

Immediate Actions Required

Restrict file upload permissions to the minimum required set of KerioConnect users until a patched version is available.
Enforce a strict Content Security Policy on the KerioConnect web interface to limit inline script execution.
Review recent uploads for filenames containing HTML or script syntax and quarantine suspicious artifacts.

Patch Information

No vendor advisory or patch has been published in the referenced sources at the time of writing. The vendor did not respond to coordinated disclosure, according to the VulDB entry. Monitor the GFI KerioConnect release notes and vendor channels for a fixed build superseding 10.0.6.

Workarounds

Rename uploaded files on ingestion to a server-generated identifier, discarding the original filename from any rendered context.
Place KerioConnect behind a reverse proxy that sanitizes Content-Disposition filenames and strips HTML control characters on upload paths.
Train users to avoid opening file listings from untrusted internal senders until mitigations are in place.

bash

# Example WAF rule concept: block uploads with HTML/script characters in filename
# ModSecurity-style pseudo-rule
SecRule REQUEST_HEADERS:Content-Disposition "@rx filename=\"[^\"]*[<>\"'].*\"" \
    "id:1002976,phase:2,deny,status:400,msg:'CVE-2025-2976 suspicious filename in upload'"