CVE-2025-27406 — Icinga Reporting Stored XSS leads to SSRF

Description

Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability present in versions 0.10.0 through 1.0.2 allows to set up a template that allows to embed arbitrary Javascript. This enables the attacker to act on behalf of the user, if the template is being previewed; and act on behalf of the headless browser, if a report using the template is printed to PDF. This issue has been resolved in version 1.0.3 of Icinga Reporting. As a workaround, review all templates and remove suspicious settings.

Affected products

Vendor	Product	Affected	Fixed
Icinga	icingaweb2-module-reporting	>= 0.10.0, < 1.0.3	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	icingaweb2-module-reporting	1.0.4-1	—
Debian 13	icingaweb2-module-reporting	1.0.4-1	—
Debian 12	icingaweb2-module-reporting	No fix yet	—

Ubuntu