CVE-2025-8552: Pybbs Tag List XSS Vulnerability

CVE-2025-8552 Overview

CVE-2025-8552 is a stored cross-site scripting (XSS) vulnerability in atjiu pybbs versions up to 6.0.0, an open-source Java-based forum application. The flaw resides in the /admin/tag/list endpoint, where the Name parameter is rendered without proper output encoding or sanitization. An authenticated attacker with administrative privileges can inject arbitrary JavaScript that executes in the browser of any user who views the affected tag list. The vulnerability is tracked under CWE-79 and was publicly disclosed with a working proof of concept. The upstream project has issued a patch via commit 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22.

Critical Impact
Successful exploitation allows injection of arbitrary script content into the administrative tag list interface, enabling session abuse, UI redress, or further admin-scoped actions against users who load the affected page.

Affected Products

atjiu pybbs versions up to and including 6.0.0
Component: /admin/tag/list administrative endpoint
Name parameter processed by TopicAdminController and related tag handling code

Discovery Timeline

2025-08-05 - CVE-2025-8552 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8552

Vulnerability Analysis

The vulnerability is a classic stored cross-site scripting (XSS) issue affecting the administrative tag management interface in pybbs. When an administrator creates or modifies a tag, the Name field accepts arbitrary input and is later rendered in /admin/tag/list without adequate HTML entity encoding. Any script payload supplied in the tag name is interpreted by the browser when the list view is loaded. Because the injection point lives behind an authenticated admin route, the attack vector is constrained but still relevant in multi-admin or role-delegated deployments. The patch introduces an XssSanitizingFilter registered through WebMvcConfig, moving sanitization to a central filter rather than relying on ad-hoc Jsoup.clean() calls scattered across controllers.

Root Cause

The root cause is missing or inconsistent input sanitization before persistence and output. The removal of Jsoup and Whitelist imports from TopicAdminController.java in the patch indicates the previous design relied on per-controller sanitization that did not cover the tag Name field. User-supplied content was stored verbatim and later emitted into HTML context without encoding.

Attack Vector

An attacker with administrative access submits a crafted tag name containing JavaScript. The payload is persisted and rendered when any user, including other administrators, loads the /admin/tag/list page. The attack is network-reachable but requires high privileges and user interaction, consistent with the stored XSS pattern in administrative CRUD workflows.

java

// Patch excerpt: WebMvcConfig.java — registration of XssSanitizingFilter
import co.yiiu.pybbs.interceptor.CommonInterceptor;
import co.yiiu.pybbs.interceptor.UserInterceptor;
import co.yiiu.pybbs.interceptor.XssSanitizingFilter;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.LocaleResolver;

Source: GitHub commit 2fe4a51

java

// Patch excerpt: TopicAdminController.java — removal of per-controller Jsoup sanitization
import co.yiiu.pybbs.util.MyPage;
import co.yiiu.pybbs.util.Result;
import org.apache.shiro.authz.annotation.RequiresPermissions;
// removed: import org.jsoup.Jsoup;
// removed: import org.jsoup.safety.Whitelist;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.util.StringUtils;

Source: GitHub commit 2fe4a51

Detection Methods for CVE-2025-8552

Indicators of Compromise

Tag records in the pybbs database whose name column contains HTML or script tokens such as <script, onerror=, onload=, or javascript:.
Web server access logs showing POST or PUT requests to /admin/tag/* endpoints with payloads containing encoded angle brackets or JavaScript keywords.
Unexpected outbound requests from admin browsers to attacker-controlled hosts shortly after loading /admin/tag/list.

Detection Strategies

Run database queries against the tag table to identify entries where the name field contains characters outside an allowed tag character set.
Instrument the admin UI with a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from tag list rendering.
Review web application firewall (WAF) logs for XSS signature matches targeting /admin/tag/list request parameters.

Monitoring Recommendations

Alert on admin session cookie reuse from unexpected IP addresses, which may indicate session theft following XSS execution.
Monitor for creation or modification of tag entities by admin accounts outside normal operational windows.
Track browser console error rates on administrative pages as a secondary signal of injected content execution.

How to Mitigate CVE-2025-8552

Immediate Actions Required

Upgrade pybbs beyond version 6.0.0 by applying commit 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22 from the upstream repository.
Audit the tag table and remove any existing records containing HTML or script content before redeploying the patched application.
Rotate administrative session credentials and invalidate active sessions after remediation to limit residual risk from prior exploitation.

Patch Information

The fix is published in the upstream repository at atjiu/pybbs commit 2fe4a51. The patch introduces a centralized XssSanitizingFilter registered via WebMvcConfig and removes scattered Jsoup.Whitelist calls from controllers, including TopicAdminController. Additional discussion is available in the upstream issue tracker.

Workarounds

Restrict access to /admin/* routes to a minimal set of trusted administrators using reverse-proxy ACLs or network segmentation.
Deploy a WAF rule to strip or block HTML metacharacters in the Name parameter of requests to /admin/tag/* endpoints.
Enforce a strict Content Security Policy that disallows inline scripts on administrative pages until the patch is applied.

bash

# Example NGINX reverse-proxy rule blocking suspicious tag payloads
location /admin/tag/ {
    if ($request_body ~* "(<script|onerror=|javascript:)") {
        return 403;
    }
    proxy_pass http://pybbs_backend;
}