EUVD-2026-55223
GHSA-6vrh-w6p3-v6fh
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L confirmed by requirement for authenticated upload account; UI:R because victim must open the file; S:C as script executes in victim's distinct browser session context.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
A stored cross-site scripting (XSS) vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check. The pkg/rclonefs/base.go PutMultipart function validates the Content-Type header supplied by the client rather than inspecting the actual file content, enabling an attacker to rename a file to .jpg while specifying image/svg+xml to bypass the filter and store a script-bearing SVG in the web root.
AnalysisAI
Stored XSS in fastschema through v0.15.1 permits any low-privileged authenticated user to store a script-bearing SVG file in the application's web root by spoofing the HTTP Content-Type header during upload. The root cause is that the PutMultipart function in pkg/rclonefs/base.go trusts the client-supplied Content-Type value rather than inspecting actual file bytes, allowing an attacker to rename an SVG to .jpg while declaring image/svg+xml and fully bypass the MIME allow-list. When a privileged user later browses to the stored file URL, the browser renders the SVG and executes the embedded JavaScript in that user's session context - a scope-changing impact that elevates the real-world risk above what the medium CVSS score alone suggests. No public exploit has been identified at time of analysis.
Technical ContextAI
fastschema is a Go-based content management and schema framework; the upload path is handled by pkg/rclonefs/base.go via the PutMultipart function, which is responsible for validating and persisting multipart file uploads. The validation logic interrogates the Content-Type HTTP header supplied by the uploading client rather than performing file-content inspection (magic-byte analysis). SVG is an XML-based image format that natively supports embedded <script> elements and JavaScript event handlers (e.g., onload, onerror), making it a well-established stored XSS vector when served from origin. CWE-79 (Improper Neutralization of Input During Web Page Generation) covers this class of flaw - the application neither sanitizes the SVG payload nor enforces content inspection to confirm the file matches its declared or stored type. The CPE cpe:2.3:a:fastschema:fastschema:*:*:*:*:*:*:*:* spans all releases up to and including v0.15.1 as the affected range.
RemediationAI
No vendor-released patch has been identified at time of analysis; operators should monitor the upstream repository at https://github.com/fastschema/fastschema and the pkg/rclonefs/base.go file for a commit addressing client-controlled Content-Type trust. The most targeted interim fix is to replace header-based MIME validation with server-side content inspection using Go's net/http.DetectContentType or a dedicated library such as h2non/filetype, which reads file magic bytes regardless of the declared header - this directly eliminates the bypass while preserving upload functionality. As an additional compensating control, restrict the file-upload role to explicitly trusted accounts to reduce the population of users who can reach the vulnerable code path; note this does not eliminate the flaw for any account that retains upload access. Configure the web server serving uploaded files to emit Content-Disposition: attachment and a strict Content-Security-Policy (e.g., default-src 'none') on the upload-serving path to prevent browsers from rendering SVG inline even if a malicious file is stored - this breaks the XSS chain without requiring application changes. If SVG upload support is not required by the application, blocking .svg uploads and rejecting image/svg+xml Content-Type declarations at the application or WAF layer is the lowest-risk workaround with no functional side effects for non-SVG workflows.
More in Fastschema
View allNULL pointer dereference in fastschema through v0.15.1 enables an unauthenticated remote attacker to crash the entire se
Remote unauthenticated account takeover in fastschema through v0.15.1 is enabled by a TOCTOU race condition in the OTP-b
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today