6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-67438

CVE-2025-67438: Sync-in Server has a stored cross-site scripting (XSS) vulnerability

A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser. By uploading a crafted SVG file containing a malicious payload, an attacker can access and exfiltrate sensitive information, including the user's session cookies.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-67438

CVE-2025-67438:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@sync-in/server	npm	< 1.9.3	1.9.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in Sync-in Server, originating from the improper handling of user-uploaded files, particularly SVG files. The root cause is that the application served these files without a Content-Disposition: attachment header, allowing browsers to render them inline. When a user uploaded a malicious SVG file, any embedded JavaScript would execute in the victim's browser in the context of the application's domain.

The analysis of the patch commit a6276d067725637310e4e83a3eee337aae81f439 reveals two primary vulnerable functions that were modified to mitigate this risk:

SendFile.send: This is the core function for file delivery. The patch removes a condition that previously allowed files to be sent without the Content-Disposition: attachment header. The updated code now enforces this header for all files sent via this class, preventing inline rendering.
UsersController.avatar: This endpoint was identified as a specific attack vector. It was modified to explicitly add the Content-Disposition: attachment header when serving avatar files. This prevents a malicious SVG avatar from being rendered by the browser, thus neutralizing the XSS threat.

By forcing all served files to be treated as attachments, the patch ensures that browsers will prompt users to download them rather than rendering them directly, effectively mitigating the stored XSS vulnerability.

Vulnerable functions

SendFile.send

backend/src/applications/files/utils/send-file.ts

This function is responsible for sending files to the client. Prior to the patch, it would only set the `Content-Disposition: attachment` header if the `asAttachment` property was true. If `asAttachment` was false, the file would be served without this header, allowing the browser to render it inline. An attacker could upload a malicious SVG file, and when another user viewed it, the browser would execute the embedded JavaScript, leading to a stored XSS vulnerability. The patch fixes this by removing the conditional logic and always forcing the `Content-Disposition` to `attachment`.

UsersController.avatar

backend/src/applications/users/users.controller.ts

This controller method serves user avatar files. Before the patch, it returned a `StreamableFile` without a `Content-Disposition` header, which instructs the browser to render the file inline if possible. If an attacker set their avatar to a crafted SVG file containing a malicious script, this endpoint would serve the file to other users' browsers, which would then execute the script. The patch mitigates this by adding a `Content-Disposition: attachment` header, forcing the browser to download the avatar instead of rendering it.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.