CVE-2025-58070: Pleasanter Stored XSS Vulnerability

CVE-2025-58070 Overview

CVE-2025-58070 is a stored cross-site scripting (XSS) vulnerability in Pleasanter, an open-source business application platform. The flaw resides in the Preview for Attachments feature, which fails to sanitize attachment content before rendering it in the browser. An attacker can upload a crafted attachment that executes arbitrary JavaScript in the context of any logged-in user who previews the file. Successful exploitation targets session integrity and enables actions performed under the victim's authenticated session. The issue is tracked under CWE-79 and disclosed through JVN Security Advisory JVN20611740.

Critical Impact
Attackers can execute arbitrary script in a logged-in user's browser through a malicious attachment preview, enabling session-scoped actions and data exposure within Pleasanter.

Affected Products

Pleasanter (versions prior to the 2025-10-24 security update)
Deployments exposing the Attachment Preview feature to authenticated users
Both on-premises and self-hosted Pleasanter instances

Discovery Timeline

2025-10-24 - Pleasanter publishes the Vulnerability Update 2025-10-24
2025-10-24 - CVE-2025-58070 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58070

Vulnerability Analysis

The vulnerability is a stored XSS flaw located in Pleasanter's Preview for Attachments feature. When a user uploads an attachment, its content is later rendered inside the preview view without adequate output encoding or content sanitization. As a result, script payloads embedded in the attachment execute in the browser of any authenticated user who opens the preview. Because the payload persists server-side, every subsequent viewer is exposed until the file is removed or the patch is applied.

The attack requires user interaction, since a victim must open the preview, but no privileges are required to seed the payload in environments that permit attachment uploads. Consequences include session token theft, forced actions within the Pleasanter UI, cross-user data disclosure, and pivoting to administrative accounts if an admin previews the file.

Root Cause

The root cause is improper neutralization of input during web page generation (CWE-79). Pleasanter's preview renderer trusts attachment content and reflects it into the DOM without escaping HTML control characters or restricting active content such as <script> tags and event handlers.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker with the ability to upload attachments crafts a file containing HTML or JavaScript. When another authenticated user opens the attachment preview, the browser parses the malicious content and executes the script inside the Pleasanter origin, inheriting the victim's session context.

No verified proof-of-concept code is publicly available. Refer to the JVN advisory and Pleasanter vendor advisory for technical details.

Detection Methods for CVE-2025-58070

Indicators of Compromise

Attachment files containing HTML, <script> tags, or JavaScript event handlers uploaded to Pleasanter items
Unexpected outbound requests from user browsers to attacker-controlled domains after opening Pleasanter previews
Anomalous session activity such as unexpected record edits or permission changes shortly after attachment previews
Web server logs showing preview endpoint requests followed by suspicious API calls from the same session

Detection Strategies

Inspect stored attachments for HTML, SVG, or scriptable MIME types that reach the preview renderer
Deploy a Content Security Policy (CSP) in report-only mode and monitor violations originating from preview URLs
Correlate attachment upload events with subsequent preview-view events across different user accounts
Hunt for reflected DOM content in preview HTTP responses using web application firewall (WAF) logs

Monitoring Recommendations

Alert on uploads of file types capable of carrying script payloads such as .html, .svg, and .xml
Monitor authenticated Pleasanter sessions for cookie access patterns and unusual API calls following preview activity
Log and review administrator sessions that open user-supplied attachments
Track user-agent and IP shifts within a single session that may indicate token theft after preview exploitation

How to Mitigate CVE-2025-58070

Immediate Actions Required

Apply the Pleasanter security update referenced in the 2025-10-24 vulnerability advisory
Restrict who can upload attachments to trusted user roles until patching is complete
Audit existing attachments for HTML, SVG, or JavaScript content and quarantine suspicious files
Invalidate active sessions after patch deployment to purge any tokens potentially stolen through prior exploitation

Patch Information

The Pleasanter project released a fixed build alongside the Vulnerability Update 2025-10-24. Administrators should upgrade to the version listed in that advisory and confirm the update via the application's version indicator. The JVN Security Advisory JVN20611740 provides additional cross-references for coordinated disclosure.

Workarounds

Disable the Attachment Preview feature or restrict it to administrators until the patch is applied
Enforce a strict Content Security Policy that blocks inline scripts on Pleasanter response pages
Serve attachments with Content-Disposition: attachment and a restrictive MIME type to prevent inline rendering
Limit accepted attachment file types to non-scriptable formats such as PDF and plain images

bash

# Example CSP header to block inline script execution in Pleasanter responses
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'