CVE-2025-35996: KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API endpoints…

PriorityP261critical9CVSS 3.1

AVNACLPRLUIRSCCHIHAH

EPSS

11.21%

95.4th percentile

KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API endpoints. That filename is later transmitted to the client in order to show a list of configuration files. Due to a missing escape or sanitization, the filename could be executed as HTML script tag resulting in a cross-site-scripting attack.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
kunbus_gmbh	revolution_pi_pictory	<= 2.11.1	—

Detection & IOCsextracted from sources · hover to see the quote

→Detect stored XSS via crafted filenames submitted to PiCtory API endpoints — the malicious filename is later reflected to the client as an HTML script tag in the configuration file listing ↗
→Monitor HTTP requests to KUNBUS PiCtory API endpoints (versions 2.11.1 and earlier) where filenames in request parameters or body contain HTML/script tag characters (e.g., `<script>`, `</script>`, `<`, `>`), indicating attempted stored XSS injection ↗
→Alert on PiCtory responses to clients that include unescaped `<script>` tags within configuration file listing data, indicating successful stored XSS payload delivery ↗

·CVE-2025-35996 requires the attacker to be authenticated (low-privilege) and requires user interaction (victim must view the configuration file list), limiting opportunistic exploitation — however, it can be chained with CVE-2025-32011 (authentication bypass via path traversal) affecting the same product versions to achieve unauthenticated stored XSS ↗
·No known public exploitation specifically targeting this vulnerability has been reported to CISA at time of publication ↗
·Affected scope is PiCtory versions 2.11.1 and earlier; version 2.12 is the patched release. Detection rules should be scoped to unpatched deployments. ↗

CVSS provenance

nvdv3.19.0CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

nvdv4.08.5HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.