Cloudanix VulnDB

CVE-2025-68927

High · 8.1

Libredesk has Improper Neutralization of HTML Tags in a Web Page

CVSS

8.1

EPSS

0.2%

Published

Dec 16, 2025

CISA due date

—

The record

LibreDesk is vulnerable to **stored HTML injection** in the contact notes feature. When adding notes via `POST /api/v1/contacts/{id}/notes`, the backend automatically wraps user input in `<p>` tags. However, by intercepting the request and removing the `<p>` tag, an attacker can inject arbitrary HTML elements such as forms and images, which are then stored and rendered without proper sanitization. This can lead to phishing, CSRF-style forced actions, and UI redress attacks. ---

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/abhinavxd/libredesk 0 No fix
Go github.com/abhinavxd/libredesk 0 0.8.6-beta

Related vulnerabilities