CVE-2025-34282 is a critical server side request forgery flaw (CVSS 9.1 in the CVE record) in ThingsBoard. An uploaded SVG in the dashboard Image Upload Gallery can make the server request a remote URL. Versions before 4.2.1 are affected. Upgrade to ThingsBoard 4.2.1 and limit what the server can reach.
What's affected
The CVE record says ThingsBoard versions below 4.2.1 are affected. The fix is released as ThingsBoard 4.2.1, which is also the version named in the VulnCheck advisory and the project's patch pull request.
A note on severity: the CVE record lists a score of 9.1, while the VulnCheck advisory shows a CVSS v4 score of 6.9 (medium). Scoring systems weigh SSRF differently, and real impact depends on what your server can reach. Use the higher number for planning when ThingsBoard runs in a network with internal services or cloud metadata endpoints.
How to check if you're exposed
Find your ThingsBoard version. In the web UI, the version appears in the About section or footer. For a container install, check the image tag:
docker ps --format '{{.Names}} {{.Image}}'
If you use a package or a Maven build, check the installed package version or your build file. Anything lower than 4.2.1 is in range.
Then review where the server can connect. From the ThingsBoard host, list which internal addresses and cloud metadata addresses are reachable. The wider that list, the more an SSRF can expose. Also check which users have permission to upload images to the gallery, because the flaw involves that feature.
What to do now
- Upgrade ThingsBoard to 4.2.1 or later using the vendor upgrade instructions for your deployment type.
- Until you upgrade, restrict who can upload to the image gallery to trusted users.
- Apply egress filtering so the ThingsBoard server cannot connect to internal admin interfaces, databases or cloud metadata services unless it needs to.
- Where your cloud provider offers it, require the more protected metadata access mode so a simple request cannot read instance credentials.
- Review outbound connection logs from the server for requests to unexpected addresses.
Why it matters
The class is CWE-918 (Server-Side Request Forgery). SVG is an XML based image format that can refer to outside resources. If server side code parses those references while handling an upload, the server itself makes the request on the attacker's behalf, from inside your network, with your network's trust.
The advisory words this carefully: the server may initiate requests if it processes the SVG in a way that parses external references. The fix in 4.2.1 changes that handling. IoT platforms often sit next to internal brokers and databases, so a server that can be tricked into calling them deserves a patch and an egress policy. The CVE is not listed in CISA KEV in the record.
Quick check
Is this exploited in the wild?
The record does not flag it as listed in CISA KEV and the advisory I checked does not report exploitation.
Why do scores differ between sources?
The CVE record shows 9.1 and VulnCheck shows 6.9 on the CVSS v4 scale. Different versions of the scoring system and different assumptions give different numbers.
Sources
Last reviewed: 18 October 2026.
