TrueConf Server
CVE-2025-66823
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L reflects mandatory authenticated conference-creator account; UI:R and S:C capture victim-triggered browser-context execution; no availability impact applies.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HTML in the Create/Edit conference functionality. The payload will be triggered when the victim opens the Conference Info page ([conference url]/info).
AnalysisAI
Stored HTML injection (CWE-79) in TrueConf Server 5.5.2.10813 on Windows enables an authenticated attacker to embed arbitrary HTML into a conference's description field, which executes in the browser of any user who visits the Conference Info page at [conference_url]/info. The CVSS Scope Change (S:C) reflects cross-context impact - payloads escape the originating session and execute within victims' browser contexts, enabling session hijacking or phishing. A public proof-of-concept is confirmed on GitHub; however, EPSS at 0.17% (7th percentile) and absence from CISA KEV indicate no known widespread exploitation at time of analysis.
Technical ContextAI
TrueConf Server is an enterprise video conferencing platform deployed exclusively on Windows per CPE cpe:2.3:a:trueconf:trueconf_server:5.5.2.10813:*:*:*:*:windows:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically in the stored variant: user-supplied input in the conference description field is persisted server-side without adequate HTML encoding or sanitization, then rendered verbatim in the Conference Info page. Because the payload is stored rather than reflected, it executes for every user who opens the target URL without any per-victim delivery step beyond access to the URL. The CVSS Scope Change metric (S:C) confirms that the injected payload operates in the victim's browser security context rather than the attacker's.
RemediationAI
No vendor-released patch or specific fixed version has been identified in the available data - patch status is unconfirmed as of this analysis. Organizations should monitor trueconf.com for an official security advisory and apply any released update promptly. As a compensating control, restrict conference creation and editing privileges to a minimal set of trusted, identifiable accounts, which shrinks the attacker pool significantly - though this does not eliminate risk from compromised or malicious authenticated users. Deploying a strict Content Security Policy (CSP) header that disallows inline script execution ('script-src self') will reduce the practical exploitability of injected payloads at the browser layer, though it does not fix the underlying input sanitization defect and CSP bypass techniques exist. Web Application Firewall rules blocking common HTML tag patterns in conference description fields can provide additional detection and partial mitigation. The public PoC is documented at https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-66823/README.md and should be reviewed to assess specific payload patterns for WAF rule tuning.
Remote code execution in TrueConf Server (versions 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and ea
Remote unauthenticated code execution in TrueConf Server (versions through 5.3.9, 5.4.9, and 5.5.5) allows a network att
Arbitrary code execution in TrueConf Client allows authenticated attackers on adjacent networks to deliver malicious upd
Stored XSS in TrueConf Server 5.5.2.10813 on Windows enables authenticated low-privileged users to inject malicious Java
CSV formula injection in TrueConf Server 5.5.2.10813 on Windows allows an authenticated low-privileged user to embed mal
Local code execution in TrueConf Client 8.5.2 lets an already-authenticated local user run arbitrary code in the context
A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated
A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows a low-p
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today