Homarr is an open-source dashboard

CVE-2025-64759 is a stored XSS in Homarr where a malicious SVG uploaded through the user-media path can execute JavaScript when rendered in a victim browser. The vendor advisory says affected versions are <= 1.43.2, patched in >= 1.43.3, and NVD mirrors that scope. The advisory also makes the critical detail explicit: the attacker must be able to upload media and edit a board, and admin takeover only happens if an administrator later views the page that renders or redirects to that SVG.

The vendor's HIGH 8.1 score is technically understandable because successful exploitation can cross privilege boundaries inside the app and end in full Homarr admin rights. In real deployments, though, this is a heavily gated chain: attacker access is already *inside* the app, the exposed population is niche, the vulnerable path often depends on public boards or delegated editors, and the chain still needs an admin view. That makes this a downgrade to MEDIUM for enterprise patch scheduling, not because the bug is harmless, but because the reachable population and attacker starting position are much narrower than the CVSS headline suggests.

Why this verdict

• Downward pressure: PR:H is real operational friction — attacker needs board-edit/media-upload capability, which implies prior access or delegated trust inside the app.
• Downward pressure: UI:R compounds the chain — an administrator must later render the malicious SVG, so exploitation is not self-driving.
• Downward pressure: narrow deployment population — Homarr is a self-hosted dashboard, not a broadly deployed enterprise control plane, so reachable population is much smaller than a generic web-app HIGH.
• Upward pressure: successful exploitation reaches full Homarr admin — once the XSS runs in an admin session, the attacker can promote themselves to credentials-admin and own the application plane.
• Upward pressure: public-board support expands edge cases — some deployments allow anonymous users and public boards, which can reduce the authentication hurdle in poorly governed instances.

Why not higher?

This is not a CRITICAL/HIGH patch-priority event for most enterprises because the exploit chain does not begin from unauthenticated remote internet access in the common case. It needs meaningful in-app rights first and then depends on admin interaction, which sharply reduces both exploit velocity and exposed population.

Why not lower?

I would not drop this to LOW because, once triggered, the outcome is still full application-admin compromise with likely access to stored integrations and secrets. Public-board deployments and loosely delegated editor roles can also make the first stage easier than the raw PR:H label suggests.

1. Remove board-edit rights from non-admins — If users do not need to edit boards or upload media, revoke it now. For a MEDIUM finding there is no noisgate mitigation SLA; use this as immediate hardening while you move to the 365-day remediation window.
2. Disable or review public boards — Public boards widen the reachable population and create anonymous-user edge cases called out by Homarr's own docs. No mitigation SLA for MEDIUM, but this is the fastest blast-radius reduction if you cannot patch immediately.
3. Block SVG uploads at the reverse proxy or app policy layer — If you can safely do so, reject image/svg+xml uploads or strip existing uploaded SVG media until all instances are on 1.43.3+. This directly cuts off the weaponized file type without waiting for a full maintenance cycle.
4. Audit admin-group changes and media uploads — Search for suspicious sequences: uploaded media, board edits, then membership changes involving credentials-admin. This will not prevent exploitation, but it improves the chance of catching a successful chain before the attacker settles in.
5. Force least privilege on Homarr integrations — Assume a compromised Homarr admin can read or abuse connected integration metadata and tokens. Reduce stored secrets and downgrade integration scopes so an app-admin compromise does not become a wider environment compromise.

Run this on the Docker host or Linux target that runs Homarr. Invoke it as bash check-homarr-cve-2025-64759.sh to scan running containers and local images, or bash check-homarr-cve-2025-64759.sh ghcr.io/homarr-labs/homarr:1.43.2 to check a specific image reference; it needs permission to talk to Docker (root or membership in the docker group).

#!/usr/bin/env bash
# check-homarr-cve-2025-64759.sh
# Detects likely exposure to CVE-2025-64759 by checking Homarr Docker image tags.
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

FIXED_VERSION="1.43.3"
TARGET_ARG="${1:-}"

have_cmd() {
  command -v "$1" >/dev/null 2>&1
}

ver_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]
}

normalize_version() {
  local v="$1"
  v="${v#v}"
  v="${v%%-*}"
  printf '%s' "$v"
}

check_ref() {
  local ref="$1"
  local tag version

  case "$ref" in
    *:*) tag="${ref##*:}" ;;
    *) tag="" ;;
  esac

  if [ -z "$tag" ] || [ "$tag" = "latest" ]; then
    return 2
  fi

  version="$(normalize_version "$tag")"

  case "$version" in
    ''|*[!0-9.]* )
      return 2
      ;;
  esac

  if ver_lt "$version" "$FIXED_VERSION"; then
    return 1
  fi
  return 0
}

if ! have_cmd docker; then
  echo "UNKNOWN"
  exit 2
fi

# If a specific image/container reference was supplied, check only that.
if [ -n "$TARGET_ARG" ]; then
  if check_ref "$TARGET_ARG"; then
    echo "PATCHED"
    exit 0
  else
    rc=$?
    if [ "$rc" -eq 1 ]; then
      echo "VULNERABLE"
      exit 1
    fi
    echo "UNKNOWN"
    exit 2
  fi
fi

found_any=0
unknown_any=0

# Check running containers first.
while IFS= read -r img; do
  [ -z "$img" ] && continue
  found_any=1
  if check_ref "$img"; then
    :
  else
    rc=$?
    if [ "$rc" -eq 1 ]; then
      echo "VULNERABLE"
      exit 1
    fi
    unknown_any=1
  fi
done < <(docker ps --format '{{.Image}}' 2>/dev/null | grep -Ei 'homarr' || true)

# If no running containers matched, check local images.
if [ "$found_any" -eq 0 ]; then
  while IFS= read -r img; do
    [ -z "$img" ] && continue
    found_any=1
    if check_ref "$img"; then
      :
    else
      rc=$?
      if [ "$rc" -eq 1 ]; then
        echo "VULNERABLE"
        exit 1
      fi
      unknown_any=1
    fi
  done < <(docker images --format '{{.Repository}}:{{.Tag}}' 2>/dev/null | grep -Ei 'homarr' || true)
fi

if [ "$found_any" -eq 0 ]; then
  echo "UNKNOWN"
  exit 2
fi

if [ "$unknown_any" -eq 1 ]; then
  echo "UNKNOWN"
  exit 2
fi

echo "PATCHED"
exit 0

Sources

1. NVD CVE-2025-64759
2. GitHub Security Advisory GHSA-wj62-c5gr-2x53
3. Homarr fix commit aaa23f3
4. Homarr release v1.43.3
5. OSV record for CVE-2025-64759
6. Homarr settings documentation
7. CISA KEV raw JSON mirror
8. FIRST EPSS overview