CVE-2025-27406: icinga icingaweb2-module-reporting Cross-site Scripting
Vulnerability summary
CVE-2025-27406 is a high (CVSS 7.7) Cross-site Scripting vulnerability in icinga icingaweb2-module-reporting. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.5% of scored vulnerabilities.
Timeline
- 26-03-2025PublishedVulnerability first disclosed.
- 26-03-2025Last modifiedVulnerability information updated.
Description
Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability present in versions 0.10.0 through 1.0.2 allows to set up a template that allows to embed arbitrary Javascript. This enables the attacker to act on behalf of the user, if the template is being previewed; and act on behalf of the headless browser, if a report using the template is printed to PDF. This issue has been resolved in version 1.0.3 of Icinga Reporting. As a workaround, review all templates and remove suspicious settings.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.6HighCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated7.6HighCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:HDiffers
- NVDNIST7.6HighCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
25%
Versus all other CVEs
30-day change
+0.01 pp
From 0.32% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected systems
Debian1 product
- icingaweb2-module-reportingAll versions (No fix recorded) | < 1.0.4-1
Icinga1 product
- icingaweb2-module-reporting≥ 0.10.0, < 1.0.3
Ubuntu1 product
- icingaweb2-module-reportingAll versions (No fix recorded)
3 vendors · 3 products
