CVE-2025-7062 — Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education

CVE-2025-7062

Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education PUBLISHED

Description (CNA)

A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.

Affected (CNA)

Vendor / product	Versions
Lumi Education UG / h5p-nodejs-library	affected 0 before 10.0.4

CWE

CWE-79, CWE-20

References

https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/
https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://seclists.org/fulldisclosure/2026/Sep/41