ThingsBoard Stored Cross-Site Scripting Vulnerability in Image Upload Gallery

A stored cross-site scripting vulnerability has been identified in ThingsBoard versions prior to 4.2.1. This issue resides in the dashboard's Image Upload Gallery feature, where an attacker can upload an SVG file embedded with malicious JavaScript. The injected script may execute when the image is displayed in the user interface. The vulnerability arises from inadequate sanitization and improper validation of the content type for uploaded SVG files.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded SVG files can execute malicious JavaScript when rendered in the UI.

Remediation

Users can upgrade to ThingsBoard version 4.2.1 or later, where this vulnerability has been fixed.