Medium severity · published Jul 2, 2025
CVE-2025-52559
Zulip XSS in digest preview URL
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Zulip is an open-source team chat application. From versions 2.0.0-rc1 to before 10.4 in Zulip Server, the /digest/ URL of a server shows a preview of what the email weekly digest would contain. This URL, though not the digest itself, contains a cross-site scripting (XSS) vulnerability in both topic names and channel names. This issue has been fixed in Zulip Server 10.4. A workaround for this issue involves denying access to /digest/.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZU
zulip · zulip
>= 2.0.0-rc1, < 10.4 · source: vendor
ZS
Zulip Server · Zulip
2.0.1 before 10.4; 2.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-52559
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-52559
Patch
https://github.com/zulip/zulip/commit/175ec1f365b0db982d6eac9019701cbf6e8bc2f2
Patch
https://github.com/zulip/zulip/commit/1a8429e338ff53bdcc4b42e7e71b6fffdd84fcd1
Patch
https://github.com/zulip/zulip/commit/6608c8777254e73a4b540e5e1c4af92e680a55fc
Patch
https://github.com/zulip/zulip/security/advisories/GHSA-vgf2-vw4r-m663
More from zulip
9.8
CVE-2022-21706
Multi-use invitations can grant access to other organizations in Zulip
9.8
CVE-2021-43799
RabbitMQ exposes ports with weak default secrets in Zulip Server
9.1
CVE-2026-102893
Zulip: OpenID Connect authentication ignores the email_verified claim
8.8
CVE-2022-31168
Zulip Server insufficient authorization for changing bot roles
8.8
CVE-2021-3967
Improper Access Control in zulip/zulip