What is CVE-2025-27609?

CVE-2025-27609 is a vulnerability in Icinga Icingaweb2, classified under Cross-site Scripting. Published 2025-03-26.

Is CVE-2025-27609 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Icinga Icingaweb2

CVE-2025-27609

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a request that, once transmitted to a victim's Icinga Web, a…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (58.7th percentile) — read the EPSS interpretation.

Affected products

Icinga Icingaweb2 — versions < 2.11.5, >= 2.12.0, < 2.12.3

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

https://github.com/Icinga/icingaweb2/security/advisories/GHSA-5cjw-fwjc-8j38 (x_refsource_CONFIRM)
https://github.com/Icinga/icingaweb2/releases/tag/v2.11.5 (x_refsource_MISC)
https://github.com/Icinga/icingaweb2/releases/tag/v2.12.3 (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-27609?: CVE-2025-27609 is a vulnerability in Icinga Icingaweb2, classified under Cross-site Scripting. Published 2025-03-26.
Is CVE-2025-27609 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.