CVE-2025-27406
Published: 26 March 2025
Summary
CVE-2025-27406 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-27406 is a cross-site scripting (XSS) vulnerability, associated with CWE-79 and CWE-918, affecting the Icinga Reporting module, a central component for reporting functionality in the Icinga Web 2 monitoring web frontend and framework. The flaw exists in versions 0.10.0 through 1.0.2, where attackers can create templates that embed arbitrary JavaScript code.
Exploitation requires network access, high privileges (PR:H), user interaction (UI:R), and high attack complexity (AC:H), as indicated by the CVSS v3.1 base score of 7.6 with changed scope (S:C) and high impacts on confidentiality, integrity, and availability. A high-privileged attacker can set up a malicious template; if a victim previews it, the embedded JavaScript executes in the user's context, allowing actions on the user's behalf. If a report using the template is printed to PDF, the JavaScript executes in the context of the headless browser, potentially enabling server-side request forgery or other actions.
The issue is fixed in Icinga Reporting version 1.0.3. As a workaround, administrators should review all templates and remove any suspicious settings. Additional details are available in the module's release notes at https://github.com/Icinga/icingaweb2-module-reporting/releases/tag/v1.0.3 and the security advisory at https://github.com/Icinga/icingaweb2-module-reporting/security/advisories/GHSA-7qvq-54vm-r7hx.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8228
Vulnerability details
Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability present in versions 0.10.0 through 1.0.2 allows to set up a template that allows to embed arbitrary Javascript.…
more
This enables the attacker to act on behalf of the user, if the template is being previewed; and act on behalf of the headless browser, if a report using the template is printed to PDF. This issue has been resolved in version 1.0.3 of Icinga Reporting. As a workaround, review all templates and remove suspicious settings.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
XSS in web application allows arbitrary JavaScript execution in user/headless browser context (T1059.007) and facilitates exploitation of the public-facing web frontend (T1190), with potential SSRF.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Information input validation prevents the injection of arbitrary JavaScript into reporting templates by high-privileged users.
Information output filtering sanitizes template content during preview or PDF generation, blocking JavaScript execution in user or headless browser contexts.
Flaw remediation requires applying the patch in Icinga Reporting version 1.0.3 to eliminate the XSS vulnerability in template processing.