FileRise CVE-2025-66403

Exploitation requires an authenticated account with file-upload permission in FileRise (PR:L) because the attacker must upload the malicious SVG, and it requires a second user to subsequently view/preview that SVG in the browser (UI:R) - the payload only fires when the app renders the SVG inline as an image in the file list or preview modal. The specific precondition is FileRise's pre-2.2.3 behavior of treating uploaded .svg files as inline-previewable images without sanitizing embedded script content. Limiting factors: it is not remote-unauthenticated (an account and upload rights are needed), it needs victim interaction, and single-user/self-only instances have minimal cross-user impact; multi-user deployments where low-privilege users can upload files viewed by admins carry the real risk.

This is a moderate, authenticated stored XSS (CWE-79) that most signals agree is NOT a high-priority, mass-exploitation threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) describes network-reachable but authenticated (PR:L) exploitation requiring victim interaction (UI:R, a user must view the malicious SVG), with scope change (S:C) because the script executes in the application's origin context, and only Low confidentiality/integrity impact and no availability impact. EPSS is 0.04% (12th percentile) - very low exploitation probability - which is consistent with the low-leverage nature of a stored XSS that depends on both an authenticated uploader and a victim rendering the file. Publicly available exploit code exists (referenced GHSA advisory), but this is distinct from active exploitation: the CVE is NOT in CISA KEV, so there is no evidence of in-the-wild use. The signals are internally consistent - no conflicts between CVSS, EPSS, and KEV. The main practical risk is privilege escalation/session-context abuse in multi-user FileRise instances where a lower-privileged user can plant an SVG that fires against an admin. Overall: a legitimately real bug with a confirmed patch, but a routine 'patch-in-normal-cycle' issue rather than an emergency.

An authenticated FileRise user with upload rights uploads a crafted .svg file containing inline JavaScript or event-handler payloads. When another user (e.g., an administrator) browses to that file and the application renders the SVG inline in the file list or preview modal, the embedded script executes in the application's origin, enabling session/token theft or actions as the victim. Public exploit/advisory material exists (GHSA-qrcv-vjvf-fr29), lowering the skill barrier.