Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction required, due to the rendering of a malicious uploaded SVG file. This could be abused to add an attacker's account to the "credentials-admin" group, giving them full administrative access, if a user logged in as an administrator was to view the page which renders or redirects to the SVG. This issue has been patched in version 1.43.3.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/homarr-labs/homarr/commit/aaa23f37321be1e110f722b36889b2fd3bea2059 Patch, Permissions Required
- https://github.com/homarr-labs/homarr/security/advisories/GHSA-wj62-c5gr-2x53 Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.1 · homarrNVD modified 2026-10-19 13:10
Affected (CPE criteria) 1
cpe:2.3:a:homarr:homarr:*:*:*:*:*:*:*:*
References 2
- https://github.com/homarr-labs/homarr/commit/aaa23f37321be1e110f722b36889b2fd3bea2059 Patch, Permissions Required
- https://github.com/homarr-labs/homarr/security/advisories/GHSA-wj62-c5gr-2x53 Patch, Vendor Advisory