N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-vhgq-r8gx-5fpv

GHSA-vhgq-r8gx-5fpv: Ibexa Admin UI assets XSS vulnerabilities in back office

Impact

This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vulnerabilities. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and can be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless.

Patches

See "Patched versions".
https://github.com/ibexa/admin-ui-assets/commit/219b71b70aaea9321947d2dbeb49fff1b49e05f4

Workarounds

None.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-vhgq-r8gx-5fpv

GHSA-vhgq-r8gx-5fpv:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ibexa/admin-ui-assets	composer	>= 4.6.0-alpha1, < 4.6.21	4.6.21

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability GHSA-vhgq-r8gx-5fpv in ibexa/admin-ui-assets is an XSS issue stemming from its dependency, ibexa/taggify. The ibexa/admin-ui-assets package was patched by updating its taggify dependency to version 1.2.2 of a fork (ibexa/taggify).

The core XSS vulnerability existed in the ibexa/taggify library (versions prior to 1.2.2 of the fork). Specifically, the Taggify JavaScript function, present in various forms (taggify.js, taggify.es6.js, taggify-script.js), used element.innerHTML = ... to render user-supplied content in two places:

When setting the label for individual tags (tag.label).
When setting the main input label for the Taggify component (finalParams.inputLabel).

If an attacker could control the content of these labels (e.g., by creating or editing content that uses tags, or by influencing the configuration of the Taggify component), they could inject arbitrary HTML and JavaScript. This script would then be executed in the context of the user viewing the tags or the Taggify component, leading to a persistent XSS attack. Since this is in the back office, users with roles like Editor or Administrator could be targeted, and the injected XSS could potentially be reflected in the front office, affecting end-users.

The patch in ibexa/taggify (commit f477177d73fbbc407d10b3ad0d5278ed6741965b) mitigates this by replacing innerHTML assignments with innerText. innerText does not parse HTML, thereby preventing the injection of executable scripts or malicious HTML structures.

The vulnerable function in a runtime profile would be Taggify, as it's the main function responsible for these unsafe DOM manipulations. The specific unsafe operations occur within this function's logic for rendering tag elements and initializing its own UI components.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-vhgq-r8gx-5fpv: Ibexa Admin UI assets XSS vulnerabilities in back office

Impact

Patches

Workarounds

GHSA-vhgq-r8gx-5fpv:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Technical Details

GHSA-vhgq-r8gx-5fpv: Ibexa Admin UI assets XSS vulnerabilities in back office

Impact

Patches

Workarounds

N/A

N/A

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI