CVE-2025-34282

Critical · CVSS 9.1

ThingsBoard — Server-Side Request Forgery (SSRF) via SVG Image Upload

CVSS: 9.1; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-918

Description

ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may initiate unintended outbound requests. This can be used to access internal services or resources.

Search profile — drives PoC discovery

Symbols Image Upload GallerySVGdashboard image uploadexternal referencesoutbound requestsSVG SSRFimage gallery endpoint

Keywords CVE-2025-34282ThingsBoard SSRFThingsBoard SVG uploadThingsBoard Image Gallery SSRFThingsBoard dashboard SVG SSRFThingsBoard 4.2.1CWE-918 ThingsBoardThingsBoard SVG external referenceThingsBoard pull 13927

Versions: < 4.2.1

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

mathitam/thingsboard-ssrf-cve-2025-34282 needs review

gh_search · Python

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-15T00:00:20.000Z · profiled 2026-07-15T00:30:20.000Z