# CVE-2025-71419: UVdesk core-framework stored cross-site scripting in SwiftMailer configuration

Source: https://junglewise.ai/threats/cve-2025-71419-uvdesk-core-framework-before-1-1-7-contains-a-stored-cross-site  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2025-71419 · Severity: medium · CVSS 5.4 · Published 2026-09-21

UVdesk core-framework is a helpdesk ticketing system framework. An agent with restricted permissions can inject malicious scripts into the mail configuration identifier field, which are then executed when administrators or other agents access the configuration page, potentially leading to account compromise or unauthorized actions.

Technologies: [UVdesk Core-Framework](https://junglewise.ai/threats/technologies/core-framework). Vendors: [UVdesk](https://junglewise.ai/threats/vendors/uvdesk).

## Quick answers

**Is CVE-2025-71419 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-71419 being exploited in the wild.

**How severe is CVE-2025-71419?** Medium severity, with a CVSS score of 5.4, published 21 September 2026.

**Which products and versions are affected?** UVdesk Core-Framework before 1.1.7.

**Is there a fix for CVE-2025-71419?** A patch was published on 2025-09-19: fix available in version 1.1.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-71419 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-71419?** Check whether you run UVdesk Core-Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored XSS vulnerability exists in the createMailerConfiguration action's identifier parameter, allowing attackers with ROLE_AGENT to inject persistent malicious scripts. The injected payload is executed in the browsers of other users accessing the SwiftMailer configuration update page. The vulnerability was patched in version 1.1.8, which includes fixes for cross-site scripting security issues.

## Affected products

- UVdesk core-framework before 1.1.7

## Timeline

- 2025-09-21: disclosed
- 2025-09-19: patched: fix available in version 1.1.8

## References

- [https://github.com/uvdesk/community-skeleton/releases/tag/v1.1.8](https://github.com/uvdesk/community-skeleton/releases/tag/v1.1.8)
- [https://github.com/uvdesk/core-framework](https://github.com/uvdesk/core-framework)

## Related threats

- [UVdesk core-framework privilege escalation in editAgent endpoint](https://junglewise.ai/threats/cve-2025-71421-uvdesk-core-framework-before-1-1-7-contains-an-improper-privilege)
- [UVdesk core-framework authorization bypass in saved reply endpoint](https://junglewise.ai/threats/cve-2025-71420-uvdesk-core-framework-before-1-1-7-contains-an-authorization)