CVE-2025-59899: Flexense Diskpulse XSS Vulnerability

CVE-2025-59899 Overview

CVE-2025-59899 is a persistent authenticated Cross-Site Scripting (XSS) vulnerability affecting Flexense Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. The flaw exists in the /server_options?sid= endpoint, where the application fails to properly validate user-supplied input. Authenticated attackers can inject malicious script payloads through the tasks_logs_dir, errors_logs_dir, error_notifications_address, status_notifications_address, and status_reports_address parameters. The injected payloads execute in the browser session of any user who subsequently views the affected configuration page. This enables session theft, credential harvesting, and unauthorized actions performed on behalf of the victim user.

Critical Impact
Authenticated attackers can persistently store JavaScript payloads in server configuration parameters, leading to session hijacking and information disclosure against other authenticated administrators.

Affected Products

Flexense Sync Breeze Enterprise Server v10.4.18
Flexense Disk Pulse Enterprise v10.4.18
Both products identified by CPE entries cpe:2.3:a:flexense:syncbreeze:10.4.18 and cpe:2.3:a:flexense:diskpulse:10.4.18

Discovery Timeline

2026-01-28 - CVE-2025-59899 published to NVD
2026-02-10 - Last updated in NVD database

Technical Details for CVE-2025-59899

Vulnerability Analysis

The vulnerability is classified under CWE-79, Improper Neutralization of Input During Web Page Generation. The affected endpoint /server_options?sid= accepts directory path and email address values without performing output encoding or input sanitization. Attackers with valid authentication can submit script payloads in place of expected configuration values. The server stores these payloads and renders them back to administrators who access the server options page. Because the payload persists in the application configuration, every subsequent visit by an authenticated user triggers script execution.

Root Cause

The application does not enforce strict input validation on the tasks_logs_dir, errors_logs_dir, error_notifications_address, status_notifications_address, and status_reports_address parameters. These fields expect filesystem paths or email addresses, but the application accepts arbitrary characters including HTML and JavaScript syntax. The rendered configuration page reflects these values without applying contextual output encoding.

Attack Vector

Exploitation requires network access to the management interface and valid low-privilege credentials. User interaction from a second authenticated user is required to trigger the stored payload. An attacker authenticates to the application, submits a crafted configuration value containing JavaScript through /server_options?sid=, and waits for an administrator to visit the affected settings page. The script executes in the administrator's session context. Refer to the INCIBE Security Notice for additional technical details.

Detection Methods for CVE-2025-59899

Indicators of Compromise

HTTP POST or GET requests to /server_options?sid= containing HTML tags such as <script>, <img>, or <svg> in the parameter values
Configuration values in tasks_logs_dir, errors_logs_dir, or notification address fields containing JavaScript event handlers like onerror=, onload=, or onclick=
Outbound HTTP connections from administrator browsers to unexpected domains shortly after accessing the Flexense management interface
Unexpected session cookie transmission to external hosts originating from administrator workstations

Detection Strategies

Inspect web server access logs for requests to /server_options containing URL-encoded angle brackets or common XSS payload signatures
Deploy web application firewall rules that flag script tags and JavaScript URI schemes in form submissions targeting the Flexense management interface
Review the current values of the five affected parameters in the application configuration for any non-path or non-email content

Monitoring Recommendations

Enable detailed HTTP request logging on the Flexense management interface and forward logs to a centralized SIEM for analysis
Monitor administrator workstations for browser-initiated connections to unknown external endpoints following management interface access
Alert on authentication events to the Flexense application from unexpected source IP addresses or outside business hours

How to Mitigate CVE-2025-59899

Immediate Actions Required

Restrict network access to the Flexense Sync Breeze and Disk Pulse management interfaces to trusted administrative networks only
Audit the current values stored in tasks_logs_dir, errors_logs_dir, error_notifications_address, status_notifications_address, and status_reports_address and remove any suspicious content
Rotate credentials for all accounts that have authenticated to the affected services since deployment
Review user accounts on the application and disable any unnecessary low-privilege accounts that could be used to plant payloads

Patch Information

No vendor patch has been published in the references available at the time of CVE publication. Consult the INCIBE Security Notice and the Flexense vendor channels for the latest fixed version information before applying any update.

Workarounds

Place the management interface behind a reverse proxy that enforces a strict Content Security Policy and strips script content from request parameters
Limit administrative access to dedicated workstations that do not browse other internet resources during active sessions
Apply browser-based script blocking extensions on administrator workstations when accessing the affected management interfaces
Use separate, hardened browser profiles exclusively for accessing the Flexense management console

bash

# Example nginx reverse proxy configuration to restrict access by source IP
location /server_options {
    allow 10.0.0.0/24;        # trusted admin subnet
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'";
    proxy_pass http://flexense-backend;
}