IDURAR ERP CRM CVE-2026-104475

Exploitation requires (1) a valid authenticated account with permission to upload files via the profile-update or settings upload endpoints (PR:L), and (2) the SVG upload path lacking content sanitization, which per the referenced fileFilterMiddleware.js in 4.1.1 permits JavaScript-bearing SVGs. The payload only fires when the file is subsequently served from the application's /public route and a victim loads it in a browser (UI:P), so successful attack depends on a victim - ideally a higher-privileged admin - viewing the malicious file. Limiting factors: authentication is mandatory, exploitation is passive/interaction-dependent rather than automatic, and impact is confined to client-side script execution in the app origin rather than direct server compromise.

This is a genuine but modest-severity issue, not a top-tier priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N) scores 5.1 (MEDIUM) and is internally consistent with the description: network-reachable, low attack complexity, but requiring low-privilege authentication (PR:L) and passive victim interaction (UI:P) - a victim must view the page where the malicious SVG is served. No EPSS score was supplied, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced in the provided data, so there is no signal of active or imminent exploitation. The impact is limited (C:L/I:L, A:N) rather than full compromise, consistent with a reflected/stored client-side XSS rather than server-side RCE. The signals do not conflict: a moderate-complexity, authenticated, interaction-dependent stored XSS in a niche open-source ERP with no exploitation evidence correctly lands as a medium-priority patch-when-practical item. Note the required authentication meaningfully constrains the attacker population, though in a multi-tenant ERP a low-privileged user attacking higher-privileged admins is a realistic insider/escalation path.

A low-privileged authenticated IDURAR user uploads a crafted SVG containing embedded JavaScript through the profile-update or settings upload endpoint, which fails to sanitize SVG content. When an administrator or other user later views a page that serves the file from the /public route, the script executes in their browser in the application's origin, enabling session/credential theft or actions on their behalf. No public exploit is referenced in the provided data, and execution depends on a victim viewing the malicious file.