EUVD-2025-208753Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-reachable stored XSS requiring authenticated upload (PR:L) and victim interaction (UI:R); scope change (S:C) reflects cross-user browser impact with no availability loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
An authenticated arbitrary file upload vulnerability in the Courses/Work Assignments module of gunet Open eClass v3.11, and fixed in v3.13, allows attackers to execute arbitrary code via uploading a crafted SVG file.
AnalysisAI
Stored cross-site scripting via SVG file upload in gunet Open eClass v3.11 permits authenticated attackers to inject and execute arbitrary JavaScript in the browsers of other users. The Courses/Work Assignments module accepts SVG uploads without stripping embedded script content, enabling session hijacking, credential theft, or further phishing against platform users who view the malicious file. No public exploit code or CISA KEV listing has been identified, and the EPSS score of 0.03% places this in the 9th percentile of exploitation likelihood.
Technical ContextAI
gunet Open eClass is an open-source learning management system maintained by the Greek Universities Network (GUnet), used primarily in Greek academic institutions. The vulnerability resides in the Courses/Work Assignments file upload handler, which fails to sanitize SVG content prior to storage and rendering. SVG is an XML-based image format that natively supports embedded JavaScript via event handlers and script elements; when a browser renders a stored SVG directly (as an image or via a direct URL), embedded scripts execute in the origin context of the hosting application. This is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation / XSS). The CVSS scope change (S:C) reflects the cross-user impact: the attacker controls one low-privilege session but can affect any user who views the uploaded file. NVD CPE data is listed as n/a:n/a, meaning the product has not yet been formally cataloged in the CPE dictionary.
RemediationAI
Upgrade to gunet Open eClass v3.13 or later, which contains the vendor-confirmed fix for this vulnerability. The upgrade path and release artifacts should be obtained from the official GUnet/Open eClass repository. If immediate upgrade is not possible, a targeted compensating control is to disable file uploads in the Courses/Work Assignments module entirely - this eliminates the attack surface but disrupts assignment submission workflows. Alternatively, enforce server-side content-type validation that rejects SVG uploads or strips script elements and event handler attributes from SVG content before storage; note that client-side validation alone is insufficient as it can be bypassed. Configuring the web server to serve uploaded files with a Content-Disposition: attachment header forces browser download rather than inline rendering, preventing embedded script execution and serves as a lower-disruption mitigation. The Huntr bounty report at https://huntr.com/bounties/540f743c-fa3e-4be6-9f85-439fff2fc5fe may contain additional technical remediation detail.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today