CVE-2025-64325: 
Homebrew vulnerability analysis and mitigation

CVE-2025-64325 is a stored Cross-Site Scripting (XSS) vulnerability in Emby Server that can be chained to achieve Remote Code Execution (RCE) on the server. A malicious authenticated user can send an authentication request with a crafted X-Emby-Client HTTP header value, which is stored and rendered unsanitized in the admin dashboard's devices section. All Emby Server versions prior to 4.8.1.0 (stable) and prior to 4.9.0.0-beta are affected; the vulnerability was tested on version 4.7.14.0. It was disclosed on November 18, 2025, with a CVSS v3.1 base score of 9.0 (Critical) and a CVSS v4.0 base score of 8.4 (High) (GitHub Advisory, Red Hat CVE).

The root cause is improper neutralization of user-controlled input during web page generation (CWE-79) combined with improper encoding or escaping of output (CWE-116). The X-Emby-Client query parameter supplied during authentication requests to /emby/Users/authenticatebyname is stored server-side and later rendered without sanitization in the admin dashboard's devices section. An attacker with low-privilege credentials crafts a malicious authentication request embedding an HTML/JavaScript payload (e.g., <img src="x" onerror="eval(...)" />) in the URL-encoded X-Emby-Client parameter. When an administrator views the devices dashboard, the stored payload executes in the admin's browser context, granting the attacker access to all admin API endpoints and session tokens (GitHub Advisory).

Successful exploitation allows a low-privilege attacker to execute arbitrary JavaScript in the context of an authenticated administrator's browser session, effectively granting full administrative API access. The published proof-of-concept exploit demonstrates a complete RCE chain: the injected script retrieves the admin's access token, uploads a malicious executable via the camera upload API, reconfigures the FFmpeg encoder path to point to the dropped executable, and triggers encoding of a video file to execute the payload on the server. This can result in persistent server compromise (e.g., via a dropped plugin DLL), full confidentiality and integrity loss of all media and server data, and potential lateral movement within the network (GitHub Advisory).

A detailed proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating the full XSS-to-RCE chain. The exploit requires low privileges (any valid Emby account) and user interaction (an administrator must view the devices dashboard), but is otherwise low complexity and network-accessible. The EPSS score is 0.071% (low probability of near-term mass exploitation), and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing (GitHub Advisory, Red Hat CVE).

1. Obtain low-privilege credentials: Register or obtain any valid Emby Server user account on the target instance.
2. Craft malicious authentication request: Send a POST request to https://<target>/emby/Users/authenticatebyname with the X-Emby-Client query parameter set to a URL-encoded XSS payload, e.g., %3Cimg%20src%3D%22x%22%20onerror%3D%22eval(...)%22%20/%3E, along with valid credentials in the JSON body.
3. Payload storage: The server stores the malicious X-Emby-Client value as the device name in the devices database without sanitization.
4. Wait for admin interaction: The payload executes when an administrator navigates to the devices section of the admin dashboard, triggering the stored XSS in their browser.
5. Steal admin token: The injected JavaScript reads the admin's access token from localStorage.servercredentials3.
6. Upload malicious executable: Using the admin token, the script calls /System/Configuration/devices to set the camera upload path, then uploads a malicious executable (e.g., rofl.exe) via /Devices/CameraUploads.
7. Reconfigure FFmpeg encoder: The script calls /Encoding/FfmpegOptions to set the custom encoder path to the uploaded executable.
8. Trigger RCE: The script requests a video stream in AVI format via /Videos/<id>/stream.avi, which triggers the encoding pipeline and executes the attacker-controlled binary on the server.
9. Establish persistence: The dropped executable can install a plugin DLL for persistent access, then reset the encoder path to avoid detection (GitHub Advisory).

• Network: Unusual POST requests to /emby/Users/authenticatebyname with URL-encoded HTML/JavaScript in the X-Emby-Client query parameter (e.g., %3Cimg, onerror, eval); outbound HTTP requests from the Emby server process to attacker-controlled hosts (e.g., http://<attacker>:8000/<executable>.exe).
• Logs: Emby server access logs showing authentication requests with anomalous X-Emby-Client values containing HTML tags or JavaScript; admin dashboard access logs showing device entries with script-like names.
• File System: Unexpected executable files (e.g., ffmpeg_backup.exe.jpg) in the Emby transcoding temp path or camera upload directories; new or modified plugin DLL files in the Emby plugins directory.
• Process: Unusual child processes spawned by the Emby server process (e.g., cmd.exe, powershell.exe, or unknown executables); changes to the FFmpeg encoder configuration pointing to non-standard paths.
• Configuration: Modifications to /System/Configuration/devices (CameraUploadPath changed to temp directory) or /Encoding/FfmpegOptions (CustomEncoderPath set to an unexpected value) (GitHub Advisory).

Upgrade Emby Server to version 4.8.1.0 (stable) or 4.9.0.0-beta (beta), which contain fixes for this vulnerability. As a temporary workaround pending patching, restrict access to the Emby admin dashboard to trusted networks only and monitor authentication logs for suspicious X-Emby-Client header values. Additionally, implement network segmentation to limit the blast radius if compromise occurs, and review the devices section of the admin dashboard for any entries containing HTML or JavaScript (GitHub Advisory, Red Hat CVE).

The Belgium Centre for Cybersecurity (CCB) issued a warning classifying this as a high-severity remote code execution vulnerability in Emby Server. INCIBE (Spain's national cybersecurity institute) also published an early alert for the vulnerability. The Emby team acknowledged the issue in their security advisory, noting that similar script injection vulnerabilities had existed across multiple versions and were addressed through a series of fixes culminating in version 4.8.1.0 (CCB Advisory, INCIBE, GitHub Advisory).