---
cve: "CVE-2025-71385"
severity: "MEDIUM"
cvss: 5.1
epss: "24%"
vendor: "netdata"
kev: false
exploited: false
published: "2026-07-02 20:17:00"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-09-16T02:18:06+02:00"
---

# CVE-2025-71385

> 5.1 MEDIUM · 🧪 PoC

## Beschreibung

Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG document (into a text element) without HTML or XML escaping, and serves the response with Content-Type image/svg+xml. An attacker can craft a URL such as /api/v2/ilove.svg?love=...; when a victim navigates to it the injected script executes in the victim browser in the origin of the Netdata instance (reflected cross-site scripting). These endpoints are registered with HTTP_ACL_NOCHECK and anonymous access and, because bearer-token protection is disabled by default, are reachable without authentication on a default Netdata agent. The issue was resolved by removing the ilove endpoint.

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |

## Patch verfügbar (OSV)

- 3417b1eeda82e77e3873de7ff15925b10c9f59e0 (Commit)
- f82554fe9b21b5ae51a8663a3f4ddce84cac16af (Commit)

## Referenzen

- <https://github.com/netdata/netdata/releases/tag/v2.3.1>
- <https://github.com/netdata/netdata/pull/19919>
- <https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af>
- <https://www.vulncheck.com/advisories/netdata-reflected-cross-site-scripting-via-love-parameter-in-ilove-svg-endpoint>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2025-71385) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_