Chatwoot CVE-2025-12246

Exploitation requires that an administrator or authorized user with access to the Chatwoot Admin Interface clicks a malicious link crafted to include JavaScript payloads in the Link parameter of the IframeLoader component. The vulnerability does not require authentication bypass - the attacker must trick an already-logged-in admin into clicking the link. No special server-side configuration or non-default settings are required; the flaw exists in the default codebase of Chatwoot 4.7.0 and earlier. Limiting factors include the requirement for user interaction (UI:P from CVSS), the need for the victim to be an admin or privileged user, and the fact that the attack payload must be delivered via a channel trusted by the target (email, messaging, etc.). Modern browsers with XSS protections may partially mitigate reflected XSS variants, but stored XSS payloads persist and execute reliably.

This vulnerability presents a low real-world risk despite public exploit availability, supported by converging signals: CVSS 2.1 indicates minimal direct severity, EPSS 0.03% (10th percentile) suggests very low exploitation probability at scale, and the CVSS vector (AV:N/AC:L/PR:N/UI:P) confirms that while remote and unauthenticated, successful exploitation requires user interaction (UI:P) - a clickable link sent to an admin. The low impact (VI:L, all other impacts null) limits damage to information disclosure. The publicly available POC suggests technical feasibility but does not correlate with active mass exploitation given the EPSS score. This is a classic low-severity XSS that requires social engineering; defenders should prioritize based on actual admin exposure to untrusted link sources rather than raw CVSS. Notably, vendor non-responsiveness (contact confirmed but no reply) may indicate low priority assignment by the maintainers themselves.

An attacker crafts a malicious URL containing JavaScript in the Link parameter (e.g., /?iframe_link=<img src=x onerror=alert(1)>) and sends it to a Chatwoot administrator via email or chat. When the admin clicks the link and the vulnerable component renders the Link argument without sanitization, the injected script executes in the admin's browser, potentially stealing session tokens, modifying data, or creating backdoor accounts. The public exploit code demonstrates the attack is trivial to execute once a victim is socially engineered.