---
title: "CVE-2025-6050"
date: "2025-06-17T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/"
---

# CVE-2025-6050

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

Fixed: Jun 4, 2025

CVE-2025-6050  **Published:** Jun 17, 2025

CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')  4.8 Medium Severity CMS Mezzanine XSS

AS Alex Shleymovich  Reported by Checkmarx Zero

Details Overview

## Summary

Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the `displayable_links_js` function, which fails to properly sanitize blog post titles before including them in JSON responses served via `/admin/displayable_links.js`. An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field, then trick another admin user into clicking a direct link to the `/admin/displayable_links.js` endpoint, causing the malicious script to execute in their browser.

## Product

This vulnerability affects Mezzanine CMS in versions prior to 6.1.1

## Impact

This stored XSS vulnerability allows one authenticated admin user to execute malicious JavaScript code in another admin user’s browser session. The impact includes session hijacking, unauthorized actions, and data exfiltration within the admin interface. While the vulnerability is limited to admin-to-admin attacks, it poses significant risks in environments with multiple administrative privilege levels.

## Steps to reproduce

1. Log in to the Mezzanine admin interface with administrative privileges
2. Navigate to **Content → Blog posts**
3. Create a new blog post with a malicious JavaScript payload in the title field:

    ```html
    <script>alert(document.cookie)</script>
    ```
4. Save the blog post
5. Create another blog post and edit its content
6. While editing, use the **Insert/edit link** functionality in the content editor. This action automatically triggers a `GET` request to `/admin/displayable_links.js`
7. Observe that the malicious script executes immediately due to the unsanitized content in the JSON response
8. Direct another admin user to click on the link: `http://[your-domain]/admin/displayable_links.js`. This can be achieved by creating another blog post and inserting a direct link to the vulnerable endpoint in the content editor.

## Remediation

A fix was released in commit [898630d](https://github.com/stephenmcd/mezzanine/commit/898630d8df48cf3ddb8b9942f59168b93216e3f8), which includes proper HTML sanitization. Users are recommended to upgrade to version 6.1.1, which includes this fix.

## Credit

This issue was discovered and reported by Checkmarx AppSec Analyst [Alex Shleymovich](https://www.linkedin.com/in/alex-shleymovich/).

## Resources

1. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-6050)
2. [Release Note](https://github.com/stephenmcd/mezzanine/releases/tag/v6.1.1)
3. [Fix commit](https://github.com/stephenmcd/mezzanine/commit/898630d8df48cf3ddb8b9942f59168b93216e3f8)
4. [Disclosure](https://github.com/stephenmcd/mezzanine/discussions/2080)

0  Medium Severity CVSS v4.0 Score

   4.8

CVSS v4.0 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Attack Requirements: None
- Privileges Required: High
- User Interaction: Passive
- Vulnerable System Confidentiality: Low
- Vulnerable System Integrity: Low
- Vulnerable System Availability: None
- Subsequent System Confidentiality: Low
- Subsequent System Integrity: None
- Subsequent System Availability: None

Advisory Timeline1. Discovered Mar 15, 2025
2. Disclosed Jun 4, 2025 The vulnerability was privately disclosed to the maintainer
3. Fixed Jun 4, 2025 A commit was released with the vulnerability fix

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/) [14 Nov 2024 CVE-2024-49764  Stored Cross-site Scripting in @LibreNMS/LibreNMS Capture Debug Information   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-49764/)