CVE-2025-69437: PublicCMS Stored XSS Vulnerability

CVE-2025-69437 Overview

CVE-2025-69437 is a stored Cross-Site Scripting (XSS) vulnerability affecting PublicCMS v5.202506.d and earlier versions. The vulnerability exists because uploaded PDF files can contain JavaScript payloads that bypass security checks implemented in the backend CmsFileUtils.java component. When a user uploads a PDF file containing a malicious payload and another user views that file, the embedded JavaScript executes in the victim's browser context, potentially leading to credential theft, arbitrary API execution, and other security concerns.

Critical Impact

Attackers with low-privilege access can upload malicious PDF files that execute arbitrary JavaScript in victims' browsers, enabling session hijacking, credential theft, and unauthorized API actions on behalf of authenticated users.

Affected Products

• PublicCMS v5.202506.d and all earlier versions
• All PublicCMS deployments using file upload functionality
• Systems utilizing affected endpoints: /cmsTemplate/save, /file/doUpload, /cmsTemplate/doUpload, /file/doBatchUpload, /cmsWebFile/doUpload

Discovery Timeline

• 2026-02-27 - CVE-2025-69437 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2025-69437

Vulnerability Analysis

This stored XSS vulnerability exploits insufficient validation of PDF file contents during the upload process. The CmsFileUtils.java backend component fails to properly sanitize or neutralize JavaScript embedded within PDF documents. PDF files inherently support JavaScript execution for interactive features, which attackers can abuse by crafting malicious payloads that execute when the document is rendered.

The vulnerability affects multiple file upload endpoints throughout the PublicCMS application, significantly expanding the attack surface. Once a malicious PDF is uploaded, any authenticated user who views the file becomes a potential victim. The cross-site nature of this attack means malicious scripts execute with the privileges of the viewing user, potentially compromising administrative accounts if they access the poisoned content.

Root Cause

The root cause stems from inadequate content inspection in the PDF upload handling logic within CmsFileUtils.java. The application accepts PDF files without stripping or neutralizing embedded JavaScript objects. PDF documents can contain various types of active content including JavaScript actions, form scripts, and document-level scripts that execute automatically or upon specific triggers. The backend validation fails to parse PDF internals and remove these potentially dangerous elements before storing and serving the files.

Attack Vector

The attack is network-based and requires an authenticated attacker with file upload privileges (low-privilege requirement). The exploitation flow involves:

1. An attacker authenticates to PublicCMS with minimal upload permissions
2. The attacker crafts a PDF document containing malicious JavaScript (e.g., cookie exfiltration, keylogging, or CSRF payloads)
3. The attacker uploads the PDF through any of the vulnerable endpoints such as /file/doUpload or /cmsTemplate/doUpload
4. The backend CmsFileUtils.java accepts and stores the file without sanitizing JavaScript content
5. When another user (potentially an administrator) views the PDF, the JavaScript executes in their browser session
6. The attacker's payload can steal session tokens, perform actions as the victim, or redirect to phishing pages

The vulnerability requires user interaction (the victim must view the malicious PDF), but the stored nature means the payload persists and can affect multiple victims over time. For detailed technical information, see the GitHub PublicCMS Issue Discussion.

Detection Methods for CVE-2025-69437

Indicators of Compromise

• Unusual PDF files uploaded to the system containing JavaScript objects or /JS streams
• PDF files with embedded app.alert(), this.submitForm(), or external URL references
• Log entries showing repeated access to specific PDF files followed by anomalous user behavior
• Authentication tokens or session cookies being transmitted to unexpected external domains

Detection Strategies

• Implement content inspection on uploaded PDF files to detect JavaScript patterns such as /JS, /JavaScript, or /OpenAction directives
• Monitor web application logs for suspicious patterns in file upload requests to endpoints like /file/doUpload and /cmsTemplate/doUpload
• Deploy browser-based XSS detection mechanisms to identify and block malicious script execution
• Analyze network traffic for data exfiltration attempts following PDF file access

Monitoring Recommendations

• Enable detailed logging for all file upload endpoints and track user access patterns to uploaded PDFs
• Configure Content Security Policy (CSP) headers to restrict script execution sources and report violations
• Implement file integrity monitoring to detect unauthorized modifications to uploaded content
• Set up alerting for any JavaScript execution attempts originating from PDF viewer contexts

How to Mitigate CVE-2025-69437

Immediate Actions Required

• Restrict file upload permissions to only essential users until a patch is applied
• Implement server-side PDF sanitization to strip JavaScript and active content from uploaded files
• Configure web servers to serve PDF files with Content-Disposition: attachment headers to force download instead of inline rendering
• Review and audit all previously uploaded PDF files for malicious content

Patch Information

At the time of publication, users should monitor the GitHub PublicCMS Issue Discussion for updates regarding official patches. The vendor has been notified through the GitHub issue tracker. Organizations should upgrade to patched versions as soon as they become available.

Workarounds

• Disable PDF file uploads entirely through application configuration until a fix is available
• Implement a whitelist-based file upload policy that only allows explicitly safe file types
• Deploy a Web Application Firewall (WAF) rule to inspect and block PDF uploads containing JavaScript signatures
• Serve all uploaded files from a separate domain to isolate potential XSS impact from the main application

# Example Apache configuration to force PDF download instead of inline viewing
<FilesMatch "\.pdf$">
    Header set Content-Disposition "attachment"
    Header set X-Content-Type-Options "nosniff"
</FilesMatch>