Security advisory: IBEXA-SA-2025-003

This security advisory resolves XSS vulnerabilities in several parts of the back office of the DXP. Back office access and varying levels of editing and management permissions are required to exploit these vulnerabilities. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and can be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless.

The Code Block in Page Builder is a special case. It's designed to accept any HTML, which includes embedded JavaScript. This means that XSS necessarily remains possible in the Code Block. As site administrator you should be aware of this when giving editors access to the Page Builder features, and limit that access only to highly trusted editors. It is possible to limit access to specific blocks per content type, where you can define which page blocks are available to an editor. Please see the documentation:
https://doc.ibexa.co/projects/userguide/en/4.6/content_management/configure_ct_field_settings/#default-configuration-of-pages 

These are the affected areas of the back office:

• Search in the dropdown
• Search autocomplete
• User name in Creator filter (Trash and Search) and Reviewer input
• Content type filter in search
• Keyword field type
• Relation list field type
• Embed and embed inline in the Rich Text editor
• Translation modal - language dropdown -> from the content tree
• Categories/Tags tag view select
• Submission in the form
• Create product type - attribute name
• Catalog - Code filter
• Catalog - Product lists - product name
• Generate variant - attribute input
• Targeting block in Page Builder
• Code block in Page Builder (see important notes above)
• Product collection block in Page Builder
• Site factory form - Domain name field
• Site factory form - Language field
• Dashboard - Products by category block
• Discounts promotion label/description in the storefront
• Shipments list
• Product - eCommerce tab in Price management (v3.x Ibexa Commerce)