CVE-2025-70849: stefanprodan podinfo
Vulnerability summary
CVE-2025-70849 is a medium (CVSS 6.1) vulnerability in stefanprodan podinfo. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 20.6% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 03-02-2026PublishedVulnerability first disclosed.
- 05-02-2026Last modifiedVulnerability information updated.
Description
Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy (CSP) or adequate Content-Type validation, leading to Stored Cross-Site Scripting (XSS).
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · GoEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
21%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.29% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 found27F3E272F474005001A9Ecd2C258Dbea
Maturity: poc
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Github.com/stefanprodan1 product
- podinfo< 1.8.1-0.20260314125853-83deb7fcb742 | All versions (No fix recorded)
Stefanprodan1 product
- podinfo≤ 6.9.0
2 vendors · 2 products
