Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education
Summary
| CVE | CVE-2025-7062 |
|---|---|
| State | PUBLISHED |
| Assigner | SCHUTZWERK |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-09 07:16:55 UTC |
| Updated | 2026-09-09 07:16:55 UTC |
| Description | A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content. |
Risk And Classification
Primary CVSS: v4.0 5.2 MEDIUM from 23637b5d-af4c-4cf9-b8f6-deb7fd0f8423
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-20 | CWE-79 | CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') | CWE-20 CWE-20 Improper Input Validation
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 23637b5d-af4c-4cf9-b8f6-deb7fd0f8423 | Secondary | 5.2 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P/C... |
| 4.0 | CNA | CVSS | 5.2 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Lumi Education UG | H5p-nodejs-library | affected 10.0.4 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007 | 23637b5d-af4c-4cf9-b8f6-deb7fd0f8423 | www.schutzwerk.com | |
| github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4 | 23637b5d-af4c-4cf9-b8f6-deb7fd0f8423 | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Florian Schmid of SCHUTZWERK GmbH (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2024-10-23T10:33:00.000Z | Vulnerability discovered |
| CNA | 2024-11-08T09:04:00.000Z | Initial contact attempt, email sent to [email protected] |
| CNA | 2024-11-20T23:00:00.000Z | Second contact attempt via a message on https://app.lumi.education/ |
| CNA | 2024-11-28T23:00:00.000Z | Third contact attempt via a message in the Lumi Slack channel |
| CNA | 2025-02-25T23:00:00.000Z | First exchange between Lumi and the team of developers who use the H5P framework in their project |
| CNA | 2025-03-07T23:00:00.000Z | Release of h5p-nodejs-library v10.0.4 (https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4), which introduces an interface for file content sanitizers and an allowlist of file types permitted in H5P modules based on their filename extension. The SVG file extension is excluded. |
| CNA | 2025-09-18T22:00:00.000Z | Identified that the allowlist approach does not prevent the upload of files with XSS content that is executed after loading |
| CNA | 2025-09-18T13:46:00.000Z | Sent email to [email protected] with an update on the finding and received a response the same day |
| CNA | 2025-09-18T15:00:00.000Z | Received a response from a developer working on Lumi Education |
| CNA | 2025-09-22T11:00:00.000Z | Video call with a developer working on Lumi Education. Received a commitment that an updated version including a fix should be ready within a few weeks |
| CNA | 2025-09-23T19:21:00.000Z | Exchange with the developer on details of the fix |
| CNA | 2025-09-24T12:18:00.000Z | Exchange with the developer on details of the fix |
| CNA | 2025-10-20T08:32:00.000Z | Requested a status update on the patch from the developer. No response received. |
| CNA | 2025-11-14T07:45:00.000Z | Requested a status update on the patch from the developer. No response received. |
| CNA | 2025-11-20T16:17:00.000Z | Requested a status update on the patch from the developer. No response received. |
| CNA | 2025-11-26T12:42:00.000Z | Informed the business contact about the current status and recommended measures for the framework developers to implement. Publication delayed for undisclosed reasons. |
| CNA | 2026-09-09T10:00:00.000Z | Advisory released |
Solutions
CNA: At the time of publication, no release fully prevents the upload and execution of files that contain JavaScript. Version 10.0.4 removes the SVG file extension from the default content allowlist, but it still identifies permitted files by their filename extension alone. An attacker can therefore upload a file with malicious JavaScript content under an allowed extension, such as XML, and have it executed. Until a complete fix is available, operators should not rely on extension-based filtering alone. Uploaded files should be validated and sanitized based on their actual content rather than their filename. For SVG uploads specifically, the library's [SVG file sanitization](https://github.com/Lumieducation/H5P-Nodejs-library/blob/v10.0.4/docs/packages/h5p-svg-sanitizer.md) can be enabled, which uses DOMPurify to remove malicious script content from uploaded files.