6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-65754

CVE-2025-65754: Algernon Cross-Site Scripting vulnerability

Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a filename.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-65754

CVE-2025-65754:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/xyproto/algernon	go	< 1.17.5	1.17.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Cross-Site Scripting (XSS) issue caused by the lack of input sanitization in several functions responsible for generating HTML content in the Algernon web server. The patch applies sanitization using the bluemonday library to user-controllable inputs across multiple functions.

The primary vector, as described, involves a crafted filename. When a user requests a non-existent file, the NoPage function is triggered. While this function had some sanitization for the filename displayed in the body of the page, it passed other parameters, like theme, to downstream functions without sanitization. The StyleHead function, for example, would then embed this unsanitized theme parameter into a <link> tag, allowing for XSS.

Furthermore, the HTMLLink function, used for generating directory listings, was also vulnerable. A file with a malicious name (e.g., <script>alert(1)</script>.html) in a directory would cause the HTMLLink function to generate an <a> tag with the malicious code embedded in it, which would then be executed by the browser when viewing the directory listing.

The patch addresses these issues by consistently applying a UGC (User Generated Content) policy from bluemonday to all relevant inputs (title, theme, url, text, headline, language) before they are embedded into the HTML output, thus mitigating the XSS risk.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.