Pleasanter CVE-2025-58070

Exploitation requires an attacker to store a malicious script via an uploaded file that is rendered through Pleasanter's Preview for Attachments feature, and a logged-in victim must then actively open that preview (UI:A) for the script to fire. Limiting factors: the payload only executes in the browser of an authenticated user who interacts with the preview (no server-side impact), and placing the attachment generally requires upload access to a Pleasanter record/site - in typical deployments that means an authenticated account, which narrows the realistic attacker set despite the vendor's PR:N rating.

This is a medium-severity stored XSS (CWE-79) with modest real-world risk signals that largely agree. The vendor-supplied CVSS 4.0 vector (base score 5.1) shows network attack vector, low complexity, no attack requirements, no privileges (PR:N) and required active user interaction (UI:A), with no impact to the vulnerable system itself (VC:N/VI:N/VA:N) but low subsequent-system confidentiality and integrity impact (SC:L/SI:L) - consistent with script execution in a victim's authenticated browser session rather than server compromise. EPSS is low (0.20%, 9th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are consistent: a stored XSS requiring a victim to preview a malicious attachment, bounded impact, low probability - this is a routine patch-in-normal-cycle issue, not an emergency. One caveat to verify: the vendor rates privileges as PR:N, but storing a malicious attachment in Pleasanter typically presupposes the ability to upload a file, which in most deployments requires an authenticated/authorized account - the PR:N rating may assume a configuration allowing anonymous or low-trust uploads, so operators should confirm their upload exposure.

An attacker uploads a file crafted with a malicious script payload as an attachment within Pleasanter; when a logged-in user opens the attachment's Preview feature, the stored script executes in that user's browser session, enabling session/data theft or actions in the victim's context. Exploitation requires the victim to actively view the preview (UI:A). No public proof-of-concept exploit was identified in the provided data.