CVE-2025-64325
Emby Server is Vulnerable to Remote Code Execution Through XSS in Admin Dashboard
Summary
Emby Server is Vulnerable to Remote Code Execution Through XSS in Admin Dashboard
Original description
The description as published by the source.
Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious user can send an authentication request with a manipulated X-Emby-Client value, which gets added to the devices section of the admin dashboard without sanitization. This issue has been patched in version 4.8.1.0 and Beta version 4.9.0.0-beta.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov