Description
Cross Site Scripting (XSS) vulnerability in AllskyTeam AllSky v2024.12.06_06 allows remote attackers to execute arbitrary code via the (1) config, (2) filename, or (3) extratext parameter to allskySettings.php. When the page is reloaded or when user visits allskySettings.php, the showMessages() function in status_messages.php will print out the error messages and execute the script injected by the attacker.
Affected products
allskyteam: allsky
References4
- gh0stmezh.wordpress.com/2025/12/04/cve-2025-65572/ ExploitThird Party Advisory
- github.com/AllskyTeam/allsky Product
- github.com/AllskyTeam/allsky/blob/master/html/includes/allskySe… Product
- github.com/AllskyTeam/allsky/blob/master/html/includes/status_m… Product
Metrics
- CVSS 3.1
-
6.1
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - EPSS — exploit probability
- 0% percentile: 39 · as of 11 November 2026
- CWE
- CWE-79
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.