CVE-2025-12776
Stored XSS in WebConsole Report Builder Allows Script Execution
Publication date: 2026-01-07
Last updated on: 2026-02-02
Assigner: Commvault
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| unknown_vendor | webconsole | * |
| commvault | commvault | From 11.36.0 (inc) to 11.36.68 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the Report Builder component of the WebConsole application storing user input directly in a web page and displaying it to other users, which raises concerns about a possible Cross-Site Scripting (XSS) attack. Although the user input is not validated during report creation, the malicious scripts are not executed when the report is run by end users. Instead, the script executes only when the report is modified through the report builder by a user with edit permissions.
How can this vulnerability impact me? :
The vulnerability can allow a user with edit permissions to execute malicious scripts when modifying reports in the Report Builder. This could potentially lead to unauthorized actions or compromise of the editing user's session or data. Since the WebConsole package is end of life and no longer maintained, unpatched vulnerabilities like this pose a security risk, especially if deployed in environments with access to sensitive data or internet connectivity.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid installing or using the WebConsole package, especially the Report Builder component, in any production environment since it is end of life and no longer maintained. If usage is necessary, deploy it only within a fully isolated network that has no access to sensitive data or internet connectivity to reduce risk exposure.