CVE catalog

CVE-2025-27406

icingaweb2-module-reporting: CVE-2025-27406

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.33% · Oct 25, 2026

Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability present in versions 0.10.0 through 1.0.2 allows to set up a template that allows to embed arbitrary Javascript. This enables the attacker to act on behalf of the user, if the template is being previewed; and act on behalf of the headless browser, if a report using the template is printed to PDF. This issue has been resolved in version 1.0.3 of Icinga Reporting. As a workaround, review all templates and remove suspicious settings.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianicingaweb2-module-reportingsid1.1.0-1fixed
Debianicingaweb2-module-reportingforky1.1.0-1fixed
Debianicingaweb2-module-reportingtrixie1.0.4-1fixed
Debianicingaweb2-module-reportingbookworm0.10.0-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianicingaweb2-module-reportingsourcesid1.0.4-1not yet assignedNot reported[1101885]
Debianicingaweb2-module-reportingsourceforky1.0.4-1not yet assignedNot reported[1101885]
Debianicingaweb2-module-reportingsourcetrixie1.0.4-1not yet assignedNot reported[1101885]
Debianicingaweb2-module-reportingsourcebookworm(unfixed)not yet assignedNot reported[1101885]

[Debian bug #1101885]

Notes

[bookworm] icingaweb2-module-reporting: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [icingaweb2-module-reporting]Affected
    Details (2)

    • 0.10.0-1 · all · bookworm

      Affected

      dsa · icingaweb2-module-reporting · debian · bookworm; dsa · icingaweb2-module-reporting · debian · 12

    • 0.10.0-1 · all · bookworm

      Affected

      dsa · icingaweb2-module-reporting · debian · bookworm; dsa · icingaweb2-module-reporting · debian · 12

[Debian 13 (Trixie)]

  • [icingaweb2-module-reporting]Fixed
    Details (2)

    • 1.0.4-1 · all · trixie

      Fixed · Fixed: 1.0.4-1

      dsa · icingaweb2-module-reporting · debian · 13

    • 1.0.4-1 · all · trixie

      Fixed · Fixed: 1.0.4-1

      dsa · icingaweb2-module-reporting · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]