Is there a public PoC exploit available for CVE-2025-8211?

Yes, a public proof-of-concept exploit is available for CVE-2025-8211. Prioritise patching immediately. EPSS: 0.1%.

Roothub CVE-2025-8211

Q: What is the CVSS score of CVE-2025-8211?

CVE-2025-8211 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-07-26 cna@vuldb.com

XSS Java Roothub

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:49 vuln.today

DescriptionCVE.org

A vulnerability was found in Roothub up to 2.6. It has been declared as problematic. Affected by this vulnerability is the function Edit of the file src/main/java/cn/roothub/web/admin/SystemConfigAdminController.java. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Roothub versions up to 2.6 contain a reflected cross-site scripting (XSS) vulnerability in the SystemConfigAdminController Edit function that allows authenticated users to inject malicious scripts via the web interface. The vulnerability requires user interaction (clicking a malicious link) and authenticated access, limiting its practical impact despite network-accessible delivery. Publicly available exploit code exists, though real-world exploitation risk is low given the EPSS score of 0.06% and the authentication barrier.

Technical ContextAI

The vulnerability exists in the Edit function of src/main/java/cn/roothub/web/admin/SystemConfigAdminController.java, a Java web controller handling system configuration updates. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating that user-supplied input is reflected in HTTP responses without proper HTML encoding or sanitization. The attack vector is network-based (AV:N), but exploitation requires prior authentication (PR:L) and user interaction (UI:P), meaning a victim must click a crafted link while authenticated. The vulnerability affects the Roothub application itself rather than an underlying framework or library.

RemediationAI

Upgrade Roothub to a version newer than 2.6 if a patched release is available from the Roothub project. If no patched version exists, immediately implement input validation and output encoding in the SystemConfigAdminController Edit function by: (1) validating all user inputs against a whitelist of acceptable characters and rejecting any containing HTML metacharacters or script tags; (2) HTML-encoding all reflected output using a secure encoding library (e.g., OWASP ESAPI) before rendering in responses; (3) implementing Content Security Policy (CSP) headers to prevent inline script execution as a defense-in-depth layer. Restrict administrative access to the SystemConfigAdminController to a minimal set of trusted administrators using network-level controls or role-based access lists. Consult the Roothub project repository and VulDB (vuldb.com/?id.317779) for patch availability and additional remediation guidance.