{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7062", "assignerOrgId": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423", "state": "PUBLISHED", "assignerShortName": "SCHUTZWERK", "dateReserved": "2025-07-04T06:13:06.914Z", "datePublished": "2026-09-09T06:14:22.143Z", "dateUpdated": "2026-09-09T06:14:22.143Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["Import of H5P modules"], "packageName": "h5p-nodejs-library", "product": "h5p-nodejs-library", "programFiles": ["packages/h5p-server/src/H5PEditor.ts"], "repo": "https://github.com/Lumieducation/H5P-Nodejs-library", "vendor": "Lumi Education UG", "versions": [{"lessThan": "10.0.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Florian Schmid of SCHUTZWERK GmbH"}], "datePublic": "2026-09-09T06:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.<br><br></div>"}], "value": "A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content."}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}, {"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.2, "baseSeverity": "MEDIUM", "exploitMaturity": "PROOF_OF_CONCEPT", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423", "shortName": "SCHUTZWERK", "dateUpdated": "2026-09-09T06:14:22.143Z"}, "references": [{"url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/"}, {"tags": ["patch"], "url": "https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div><span><span>At the time of publication, no release fully prevents the upload and execution of files that contain JavaScript. Version 10.0.4 removes the SVG file extension from the default content allowlist, but it still identifies permitted files by their filename extension alone. An attacker can therefore upload a file with malicious JavaScript content under an allowed extension, such as XML, and have it executed.</span></span></div><div><span><span><br></span></span></div><div><span><span>Until a complete fix is available, operators should not rely on extension-based filtering alone. Uploaded files should be va</span>li<span>d</span>at<span>ed and sanitized based on their actual content rather than their filename. For SVG uploads specifically, the library's </span><span><span>[</span></span><span><span>SVG file sanitization</span></span><span><span>](</span></span><span><span>https://github.com/Lumieducation/H5P-Nodejs-library/blob/v10.0.4/docs/packages/h5p-svg-sanitizer.md</span></span><span><span>)</span></span><span> can be enabled, which</span> uses <span>DOMPurify to remove malicious script content from uploaded file</span>s.</span></div>"}], "value": "At the time of publication, no release fully prevents the upload and execution of files that contain JavaScript. Version 10.0.4 removes the SVG file extension from the default content allowlist, but it still identifies permitted files by their filename extension alone. An attacker can therefore upload a file with malicious JavaScript content under an allowed extension, such as XML, and have it executed.\n\n\n\n\nUntil a complete fix is available, operators should not rely on extension-based filtering alone. Uploaded files should be validated and sanitized based on their actual content rather than their filename. For SVG uploads specifically, the library's [SVG file sanitization](https://github.com/Lumieducation/H5P-Nodejs-library/blob/v10.0.4/docs/packages/h5p-svg-sanitizer.md) can be enabled, which uses DOMPurify to remove malicious script content from uploaded files."}], "source": {"discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2024-10-23T10:33:00.000Z", "value": "Vulnerability discovered"}, {"lang": "en", "time": "2024-11-08T09:04:00.000Z", "value": "Initial contact attempt, email sent to c@lumi.education"}, {"lang": "en", "time": "2024-11-20T23:00:00.000Z", "value": "Second contact attempt via a message on https://app.lumi.education/"}, {"lang": "en", "time": "2024-11-28T23:00:00.000Z", "value": "Third contact attempt via a message in the Lumi Slack channel"}, {"lang": "en", "time": "2025-02-25T23:00:00.000Z", "value": "First exchange between Lumi and the team of developers who use the H5P framework in their project"}, {"lang": "en", "time": "2025-03-07T23:00:00.000Z", "value": "Release of h5p-nodejs-library v10.0.4 (https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4), which introduces an interface for file content sanitizers and an allowlist of file types permitted in H5P modules based on their filename extension. The SVG file extension is excluded."}, {"lang": "en", "time": "2025-09-18T22:00:00.000Z", "value": "Identified that the allowlist approach does not prevent the upload of files with XSS content that is executed after loading"}, {"lang": "en", "time": "2025-09-18T13:46:00.000Z", "value": "Sent email to security@lumi.education with an update on the finding and received a response the same day"}, {"lang": "en", "time": "2025-09-18T15:00:00.000Z", "value": "Received a response from a developer working on Lumi Education"}, {"lang": "en", "time": "2025-09-22T11:00:00.000Z", "value": "Video call with a developer working on Lumi Education. Received a commitment that an updated version including a fix should be ready within a few weeks"}, {"lang": "en", "time": "2025-09-23T19:21:00.000Z", "value": "Exchange with the developer on details of the fix"}, {"lang": "en", "time": "2025-09-24T12:18:00.000Z", "value": "Exchange with the developer on details of the fix"}, {"lang": "en", "time": "2025-10-20T08:32:00.000Z", "value": "Requested a status update on the patch from the developer. No response received."}, {"lang": "en", "time": "2025-11-14T07:45:00.000Z", "value": "Requested a status update on the patch from the developer. No response received."}, {"lang": "en", "time": "2025-11-20T16:17:00.000Z", "value": "Requested a status update on the patch from the developer. No response received."}, {"lang": "en", "time": "2025-11-26T12:42:00.000Z", "value": "Informed the business contact about the current status and recommended measures for the framework developers to implement. Publication delayed for undisclosed reasons."}, {"lang": "en", "time": "2026-09-09T10:00:00.000Z", "value": "Advisory released"}], "title": "Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education", "x_generator": {"engine": "Vulnogram 0.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["Import of H5P modules"], "packageName": "h5p-nodejs-library", "product": "h5p-nodejs-library", "programFiles": ["packages/h5p-server/src/H5PEditor.ts"], "repo": "https://github.com/Lumieducation/H5P-Nodejs-library", "vendor": "Lumi Education UG", "versions": [{"lessThan": "10.0.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content."}], "id": "CVE-2025-7062", "lastModified": "2026-09-09T15:52:04.827", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423", "type": "Secondary"}]}, "published": "2026-09-09T07:16:55.180", "references": [{"source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423", "url": "https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4"}, {"source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423", "url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/"}], "sourceIdentifier": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-79"}], "source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423", "type": "Secondary"}]}

{}

{"created": "2026-09-09T10:30:09.164616+00:00", "updated": "2026-09-09T10:30:09.164622+00:00", "vendors": []}