MEDIUM Published September 26, 2025

CVE-2025-57292

Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The application fails to properly validate the MIME type and sanitize image metadata.

CVSS base score
6.1 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-79
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

doist todoist

References

View full NVD advisory →

More doist vulnerabilities

Published the same day

Related reading

← Back to CVE watch