CVE-2025-24372
XSS vector in user uploaded images in group/org and user profiles in ckan
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could lead to escalation of privileges of the original submitter or other malicious actions. Users must have been registered to the site to exploit this vulnerability. This vulnerability has been fixed in CKAN 2.10.7 and 2.11.2. Users are advised to upgrade. On versions prior to CKAN 2.10.7 and 2.11.2, site maintainers can restrict the file types supported for uploading using the ckan.upload.user.mimetypes / ckan.upload.user.types and ckan.upload.group.mimetypes / ckan.upload.group.types config options. To entirely disable file uploads users can use: ckan.upload.user.types = none
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
XSS vector in user uploaded images in group/org and user profiles in ckan
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could lead to escalation of privileges of the original submitter or other malicious actions. Users must have been registered to the site to exploit this vulnerability. This vulnerability has been fixed in CKAN 2.10.7 and 2.11.2. Users are advised to upgrade. On versions prior to CKAN 2.10.7 and 2.11.2, site maintainers can restrict the file types supported for uploading using the ckan.upload.user.mimetypes / ckan.upload.user.types and ckan.upload.group.mimetypes / ckan.upload.group.types config options. To entirely disable file uploads users can use: ckan.upload.user.types = none
- Record
CVE-2025-24372- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-0234
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could lead to escalation of privileges of the original submitter or other malicious actions. Users must have been registered to the site to exploit this vulnerability. This vulnerability has been fixed in CKAN 2.10.7 and 2.11.2. Users are advised to upgrade. On versions prior to CKAN 2.10.7 and 2.11.2, site maintainers can restrict the file types supported for uploading using the ckan.upload.user.mimetypes / ckan.upload.user.types and ckan.upload.group.mimetypes / ckan.upload.group.types config options. To entirely disable file uploads users can use: ckan.upload.user.types = none
- Record
EUVD-2025-0234- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7pq5-qcp6-mcww
CKAN has an XSS vector in user uploaded images in group/org and user profiles
Impact
Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could lead to escalation of privileges of the original submitter or other malicious actions. Users must have been registered to the site to exploit this vulnerability.
Patches
This vulnerability has been fixed in CKAN 2.10.7 and 2.11.2
Workarounds
On versions prior to CKAN 2.10.7 and 2.11.2, site maintainers can restrict the file types supported for uploading using the ckan.upload.user.mimetypes / ckan.upload.user.types and ckan.upload.group.mimetypes / ckan.upload.group.types config options. To entirely disable file uploads you can use:
ckan.upload.user.types = none
- Record
GHSA-7pq5-qcp6-mcww- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could lead to escalation of privileges of the original submitter or other malicious actions. Users must have been registered to the site to exploit this vulnerability. This vulnerability has been fixed in CKAN 2.10.7 and 2.11.2. Users are advised to upgrade. On versions prior to CKAN 2.10.7 and 2.11.2, site maintainers can restrict the file types supported for uploading using the ckan.upload.user.mimetypes / ckan.upload.user.types and ckan.upload.group.mimetypes / ckan.upload.group.types config options. To entirely disable file uploads users can use: ckan.upload.user.types = none
- Record
CVE-2025-24372- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
XSS vector in user uploaded images in group/org and user profiles in ckan
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could lead to escalation of privileges of the original submitter or other malicious actions. Users must have been registered to the site to exploit this vulnerability. This vulnerability has been fixed in CKAN 2.10.7 and 2.11.2. Users are advised to upgrade. On versions prior to CKAN 2.10.7 and 2.11.2, site maintainers can restrict the file types supported for uploading using the ckan.upload.user.mimetypes / ckan.upload.user.types and ckan.upload.group.mimetypes / ckan.upload.group.types config options. To entirely disable file uploads users can use: ckan.upload.user.types = none
- Record
CVE-2025-24372- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-7pq5-qcp6-mcww
CKAN has an XSS vector in user uploaded images in group/org and user profiles
Impact
Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could lead to escalation of privileges of the original submitter or other malicious actions. Users must have been registered to the site to exploit this vulnerability.
Patches
This vulnerability has been fixed in CKAN 2.10.7 and 2.11.2
Workarounds
On versions prior to CKAN 2.10.7 and 2.11.2, site maintainers can restrict the file types supported for uploading using the ckan.upload.user.mimetypes / ckan.upload.user.types and ckan.upload.group.mimetypes / ckan.upload.group.types config options. To entirely disable file uploads you can use:
ckan.upload.user.types = none
- Record
GHSA-7pq5-qcp6-mcww- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVPYSEC-2026-1250
CKAN has an XSS vector in user uploaded images in group/org and user profiles
Impact
Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could lead to escalation of privileges of the original submitter or other malicious actions. Users must have been registered to the site to exploit this vulnerability.
Patches
This vulnerability has been fixed in CKAN 2.10.7 and 2.11.2
Workarounds
On versions prior to CKAN 2.10.7 and 2.11.2, site maintainers can restrict the file types supported for uploading using the ckan.upload.user.mimetypes / ckan.upload.user.types and ckan.upload.group.mimetypes / ckan.upload.group.types config options. To entirely disable file uploads you can use:
ckan.upload.user.types = none
- Record
PYSEC-2026-1250- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ckanPyPI |
before 2.10.7 | 2.10.7 |
ckanPyPI |
2.11.0 up to 2.11.2 | 2.11.2 |
ckanPyPI |
before 2.10.7, plus listed versions 0.110.30.40.50.6 Show 45 moreShow less0.70.81.01.11.21.31.3.21.3.31.41.4.11.4.21.4.31.4.3.11.51.5.11.61.71.7.11.82.02.0.12.0.72.0.82.12.1.12.1.52.1.62.10.02.10.12.10.32.10.42.10.52.10.62.22.2.12.2.32.2.42.32.3.12.3.22.3.32.3.42.3.52.4.02.4.1 |
2.10.7 |
ckanPyPI |
2.11.0 up to 2.11.2, plus listed versions 2.11.1 |
2.11.2 |
ckanPyPI |
before 2.10.7, 2.11.0 up to 2.11.2, plus listed versions 0.110.30.40.50.6 Show 45 moreShow less0.70.81.01.11.21.31.3.21.3.31.41.4.11.4.21.4.31.4.3.11.51.5.11.61.71.7.11.82.02.0.12.0.72.0.82.12.1.12.1.52.1.62.10.02.10.12.10.32.10.42.10.52.10.62.11.12.22.2.12.2.32.2.42.32.3.12.3.22.3.32.3.42.3.52.4.0 |
2.10.72.11.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-24372 is a high vulnerability (CVSS 7.3) in Ckan, published February 5, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in ckan 2.10.7.
References
github.com/ckan/ckan/security/advisories/GHSA-7pq5-qcp6-mcww
docs.ckan.org/en/latest/maintaining/configuration.html
nvd.nist.gov/vuln/detail/CVE-2025-24372
pypi.org/project/ckan
Left out here: 125 versions. The JSON record has them.