CVE-2025-55735 — flaskBlog Stored XSS Vulnerability
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when creating a post, there's no validation of the content of the post stored in the variable "postContent". The …
Published: 2025-08-19 · CVSS: 5.3 · CVSS 4.0
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when creating a post, there's no validation of the content of the post stored in the variable "postContent". The vulnerability arises when displaying the content of the post using the | safe filter, that tells the engine to not escape the rendered content. This can lead to a stored XSS inside the content of the post. The code that causes the problem is in template/routes.html.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7