CVE-2025-24372

Description

CKAN has an XSS vector in user uploaded images in group/org and user profiles

Predictions

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

References

• https://github.com/ckan/ckan/security/advisories/GHSA-7pq5-qcp6-mcww
• https://nvd.nist.gov/vuln/detail/CVE-2025-24372
• https://github.com/ckan/ckan/commit/7da6a26c6183e0a97a356d1b1d2407f3ecc7b9c8
• https://github.com/ckan/ckan/commit/a4fc5e06634ed51d653ab819a7efc8e62f816f68
• https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-group-mimetypes
• https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-group-types
• https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-user-mimetypes
• https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-user-types
• https://github.com/ckan/ckan