Is CVE-2025-65676 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-65676 being exploited in the wild.

How severe is CVE-2025-65676?

Medium severity, with a CVSS score of 5.4, published 26 November 2025.

Is there a fix for CVE-2025-65676?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-65676 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-65676?

Check whether you run Classroomio or Classroomio LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-65676: Classroomio LMS Stored XSS in SVG cover images

CVE-2025-65676 · Severity: medium · CVSS 5.4 · Published 2025-11-26

Classroomio LMS, an open-source education platform, contains a security flaw in how it handles course cover images. An authorized user, such as an instructor, can upload a specially crafted image file that contains hidden malicious code. When other users view the course page, this code runs automatically in their browser, potentially allowing the attacker to hijack user sessions or steal sensitive account information.

Technologies: Classroomio. Vendors: Classroomio.

Quick answers

Is CVE-2025-65676 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-65676 being exploited in the wild.
How severe is CVE-2025-65676?: Medium severity, with a CVSS score of 5.4, published 26 November 2025.
Which products and versions are affected?: Classroomio LMS 0.1.13.
Is there a fix for CVE-2025-65676?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-65676 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-65676?: Check whether you run Classroomio or Classroomio LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Classroomio LMS version 0.1.13 due to improper sanitization of uploaded SVG files used as course cover images. An authenticated attacker can upload a malicious SVG file containing embedded JavaScript via the 'Header > replace image cover' functionality on a course landing page. When the image is rendered or viewed by other users, the embedded script executes within their browser session. This can lead to session hijacking, unauthorized actions on behalf of other users, or account takeover. The vulnerability is tracked as CWE-79 and requires a low-privileged authenticated user to perform the upload and a victim to view the affected page.

Affected products

Classroomio Classroomio LMS 0.1.13

Timeline

2025-11-26: disclosed: Initial disclosure of CVE-2025-65676
2025-11-26: advisory: NVD published the vulnerability record

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.