HTML Injection in IBM Aspera Shares 1.9.9–1.11.0 Enables Remote Attack

Publication date: 2026-04-01

Last updated on: 2026-04-03

Assigner: IBM Corporation

Description

IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-01

Last Modified

2026-04-03

Generated

2026-07-06

AI Q&A

2026-04-02

EPSS Evaluated

2026-07-05

NVD

CVE-2025-66486

EUVD

EUVD-2025-209184

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	aspera_shares	From 1.9.9 (inc) to 1.11.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-80	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

Executive Summary

IBM Aspera Shares versions 1.9.9 through 1.11.0 contain a vulnerability known as HTML injection. This means a remote attacker can insert malicious HTML code into the application. When a victim views this injected content in their web browser, the malicious code executes within the security context of the hosting site.

Impact Analysis

This vulnerability can allow an attacker to execute malicious HTML code in the victim's browser, potentially leading to unauthorized actions or data exposure within the context of the affected site. The CVSS score indicates that the attack can be performed remotely with low attack complexity but requires high privileges and user interaction. The impact includes limited confidentiality and integrity loss but no availability impact.

Hi! I’m here to help you understand CVE-2025-66486. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70