{"id":"CVE-2021-25938","details":"In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting (XSS), since there is no validation of the .zip file name and filtering of potential abusive characters which zip files can be named to. There is no X-Frame-Options Header set, which makes it more susceptible for leveraging self XSS by attackers.","modified":"2026-07-09T00:37:11.070769Z","published":"2021-05-24T11:15:08.470Z","references":[{"type":"FIX","url":"https://github.com/arangodb/arangodb/commit/3e486b9bc33cc97e92645dd279899000e57f61f4"},{"type":"EVIDENCE","url":"https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25938"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/arangodb/arangodb","events":[{"introduced":"5f32b5ebd1bc7b6698439902a375a47819d41e15"},{"last_affected":"1bb10a05e369bd3cdc3b95f59fb874dcc34020ea"},{"fixed":"3e486b9bc33cc97e92645dd279899000e57f61f4"}],"database_specific":{"cpe":"cpe:2.3:a:arangodb:arangodb:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.2.6.2"},{"last_affected":"3.7.10"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-25938.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}