Cross-site scripting in Graylog - CVE-2025-46827
Published: May 7, 2025 / Updated: June 25, 2026
Vulnerability identifier: #VU135311
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-46827
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Graylog
Affected software:
Graylog
Graylog
Detailed vulnerability description
The vulnerability allows a remote user to obtain user session cookies.
The vulnerability exists due to insufficient HTML sanitization in the Event Definition Remediation Step field when rendering attacker-supplied HTML content. A remote user can submit a crafted HTML form to obtain user session cookies.
Exploitation requires a user account with permissions to create event definitions, a victim with permissions to view alerts, and an active input on the server capable of receiving form data.
How to mitigate CVE-2025-46827
Install security update from vendor's website.