CVE-2025-65187: CiviCRM Stored XSS Vulnerability

CVE-2025-65187 Overview

CVE-2025-65187 is a stored cross-site scripting (XSS) vulnerability affecting CiviCRM versions prior to 6.7. The flaw resides in the Accounting Batches field, where authenticated users can inject malicious JavaScript. The payload persists on the server and executes in the browser of any user who subsequently views the affected page. This vulnerability is classified under [CWE-79] and stems from insufficient output encoding of user-supplied content. CiviCRM is a widely deployed constituent relationship management platform used by non-profits, associations, and civic organizations.

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in the browser context of other CiviCRM users, enabling session hijacking, credential theft, and unauthorized actions performed on behalf of victims.

Affected Products

• CiviCRM versions before 6.7
• CiviCRM deployments exposing the Accounting Batches feature
• Any CiviCRM instance with authenticated user access to financial batch management

Discovery Timeline

• 2025-12-02 - CVE-2025-65187 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-65187

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the CiviCRM Accounting Batches functionality. An authenticated user submits JavaScript payloads into the Accounting Batches field, and the application persists the raw input without adequate sanitization or contextual output encoding. When any user with permission to view the affected batch loads the page, the browser parses and executes the injected script in the origin of the CiviCRM instance.

The attack requires user interaction to trigger, since a victim must navigate to the page rendering the malicious content. However, because the payload is stored server-side, exploitation scales to every user who accesses the compromised batch. Successful exploitation can lead to session token theft, arbitrary requests submitted as the victim, phishing overlays inside the trusted application, and pivoting toward administrative accounts.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. CiviCRM stored the Accounting Batches field value and rendered it back into HTML without escaping characters such as <, >, and quotation marks. This allowed script tags and event handler attributes supplied by authenticated users to become part of the executable DOM of the batch view page.

Attack Vector

The attack vector is network-based and requires an authenticated session with permission to create or edit accounting batches. The attacker injects a JavaScript payload into the Accounting Batches field and saves the record. A second user with access to view accounting batches triggers execution simply by loading the batch listing or detail page. The scope change reflects that code executes in the victim's browser context, potentially reaching data and permissions outside the attacker's own account. See the GitHub CVE-2025-65187 Report for reproduction details.

Detection Methods for CVE-2025-65187

Indicators of Compromise

• Accounting batch records containing <script> tags, javascript: URIs, or DOM event handlers such as onerror, onload, or onmouseover in text fields.
• Unexpected outbound requests from user browsers to attacker-controlled domains shortly after loading CiviCRM accounting pages.
• CiviCRM audit logs showing batch create or update events from accounts that do not normally perform financial operations.

Detection Strategies

• Review the CiviCRM database civicrm_batch table for stored HTML or JavaScript content in text fields using pattern matching for angle brackets and script keywords.
• Deploy a web application firewall (WAF) rule that inspects POST bodies to accounting batch endpoints for common XSS payloads.
• Enable Content Security Policy (CSP) reporting and monitor report-uri endpoints for script-src violations originating from CiviCRM pages.

Monitoring Recommendations

• Alert on anomalous session activity such as concurrent logins from different geographies for accounts that recently viewed accounting batches.
• Log and review all HTTP requests to /civicrm/batch and related financial endpoints for suspicious payloads.
• Correlate CiviCRM application logs with browser CSP violation reports to identify active exploitation attempts.

How to Mitigate CVE-2025-65187

Immediate Actions Required

• Upgrade CiviCRM to version 6.7 or later on all production and staging environments.
• Audit existing accounting batch records for stored HTML or JavaScript and sanitize or delete any malicious entries.
• Restrict the permissions required to create and edit accounting batches to the minimum set of trusted financial users.

Patch Information

CiviCRM addressed the vulnerability in version 6.7 by applying proper output encoding to the Accounting Batches field. Administrators should upgrade to this release or a later version. Refer to the CiviCRM Official Website for release downloads and upgrade documentation.

Workarounds

• Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
• Temporarily revoke the CiviCRM permission to create or edit batches for non-essential users until patching is complete.
• Configure a WAF to block requests containing script tags or JavaScript event handlers targeting CiviCRM financial endpoints.

# Example Content-Security-Policy header for CiviCRM web server
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; report-uri /csp-report"