CVE-2025-71419

Summary

The flaw allows attackers with ROLE_AGENT to inject malicious scripts via the SwiftMailer configuration identifier parameter, leading to cross-site scripting (XSS) attacks.

Exploitability

Exploitation requires an attacker to have ROLE_AGENT privileges and control over the identifier field; moderate effort is needed.

Blast radius

If exploited, this could result in unauthorized script execution for other members accessing the configuration update page, potentially leading to data theft or further compromise.

Prioritized remediation

Update to UVdesk core-framework version 1.1.7 or later to mitigate the vulnerability.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.