EUVD-2026-85887
GHSA-mgqc-836v-2pjm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryUpload crafted SVG with script element
-
ExploitFile served from app origin
-
ExecutionLure victim to open file URL
-
ImpactScript executes, steals session cookie/CSRF token
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account with access to any file-upload field in Aureus ERP through 1.6.0 (the vulnerable configuration accepts 'svg' in config/livewire.php allowed mimes and multiple Filament upload actions accept 'image/*'). Exploitation depends on SVG files being stored on the public disk and served inline from the application origin, and on a victim opening the uploaded file's direct URL (UI:P) for the embedded script to execute. Limiting factors: attacker must be authenticated (PR:L), a separate victim must open the file URL, and the impact is confined to script execution in the app origin (cookie/CSRF-token theft) rather than server compromise. |
| Impact | This is a genuine but moderate-severity issue best treated as a standard patch-cycle item rather than an emergency. The vendor-provided CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:P/VC:L/VI:L/SC:L/SI:L) describes a network-reachable but authenticated (PR:L) stored XSS that requires a victim to open the malicious SVG URL directly (UI:P/passive interaction), yielding only Low confidentiality and integrity impact - consistent with cookie/CSRF-token theft rather than direct code execution or data destruction (VA:N/A:N). No EPSS score is provided and the CVE is not listed in CISA KEV, so there is no evidence of widespread or automated exploitation. A detailed public technical write-up (hackmd by leediay) and a VulnCheck advisory document the technique, lowering the barrier to weaponization, but no packaged exploit tool is referenced. The signals are internally consistent - there is no CVSS-vs-description conflict - and the main mitigating factors are the authentication requirement and the need to lure a logged-in victim into opening the file, which keep real-world risk moderate. |
| Exploit ScenarioDerived | An authenticated Aureus ERP user (e.g., a low-privileged staff account) uploads an SVG file containing an embedded <script> element through one of the file-upload fields, which is stored on the public disk and served from the application origin. The attacker then sends the direct file URL to a higher-privileged user; when that victim opens it, the script executes in the application's origin and exfiltrates their session cookie and CSRF token. A public technical write-up describing the technique exists, but no packaged exploit code is referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Stored cross-site scripting in Aureus ERP through 1.6.0 allows an authenticated user to upload an SVG file containing embedded JavaScript that is written to the application's public disk and served from the application origin, so the script executes in a victim's browser session when the uploaded file's direct URL is opened. Successful exploitation enables theft of session cookies and CSRF tokens, giving the attacker the ability to act as the victim within the ERP; independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (vendor score 5.1), reflecting a cross-site scripted response that requires a second user to open the crafted file URL. Exploitation prerequisites are non-trivial - the attacker must hold an authenticated account with access to a file-upload field and the victim must navigate to the stored file - and no public exploit identified at time of analysis, so this is best handled as a standard patch-cycle item rather than an emergency.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the changes from Aureus ERP pull request 1574 (https://github.com/aureuserp/aureuserp/pull/1574) and, if the project later tags a release containing it, upgrade to that version rather than remaining on 1.6.0. The patch removes 'svg' from the allowed mimes in config/livewire.php, replaces the wildcard 'image/*' allowance with the explicit raster list image/jpeg, image/png, image/gif, image/bmp and image/webp across the support, accounts, blogs and chatter upload actions, and swaps preserveFilenames() for getUploadedFileNameForStorageUsing() so stored names are slugged and random-prefixed with a guessed extension. If you cannot deploy the patch immediately, remove 'svg' and narrow every 'image/*' rule in your own config to a raster-only allow-list - the trade-off is that legitimate SVG logo and attachment uploads will be rejected - and treat all files already stored on the public disk as untrusted, purging existing SVG uploads because the payload is persistent. Because the file URL is reachable directly, also harden delivery: serve the upload path from a separate origin (or a CDN/sandbox domain) so any script executes cross-origin, or force download via Content-Disposition: attachment on the storage path and apply a restrictive Content-Security-Policy (sandbox, no inline script) to that route - both cost inline image preview convenience. Adding HttpOnly and SameSite=Strict to the session cookie blunts cookie theft but does not stop CSRF-token exfiltration, and enabling SSR-based SVG sanitization (e.g., DOMPurify or a server-side SVG filter) is a complementary control for any remaining SVG handling.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic stored XSS (CWE-79, improper neutralization of user-controlled input during web page generation) enabled by SVG's dual nature as both an image format and an XML document that can legally contain <script> elements and event handlers. Aureus ERP (a Laravel/Filament/Livewire-based ERP by Webkul) configured its Livewire file-upload rules in config/livewire.php to accept a mimes list that explicitly included 'svg' and a mimetypes list built on broad wildcards such as 'image/*'; several Filament upload actions - including the Webkul support plugin's CompanyForm branding field and ManageBranding settings page, the accounts plugin's PrintAndSendAction, the blogs plugin's PostForm cover image, and the chatter FileAction, LogAction and MessageAction attachments - likewise accepted 'image/*' and preserved original filenames. Because uploaded files are placed on the public disk and served inline from the same application origin, a browser requested to open the SVG URL parses and executes the embedded script in that origin's context, with full access to cookies not marked HttpOnly and to in-page CSRF tokens; no MIME sniffing or content-type mismatch is required since SVG is natively scriptable. The upstream fix in pull request 1574 removes 'svg' from the allowed mimes, replaces 'image/*' with an explicit raster allow-list (image/jpeg, image/png, image/gif, image/bmp, image/webp), and replaces preserveFilenames() with getUploadedFileNameForStorageUsing() to store slugged, random-prefixed names with a guessed extension - eliminating both the scriptable format and the uploader-controlled filename path.
Know when Aureus Erp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Authenticated upload gives PR:L, victim must open the file URL so UI:R; script runs in the app origin affecting another user's session so S:C with C:L/I:L, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Aureus ERP through 1.6.0 stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
More in Aureus Erp
View allSensitive information exposure in Webkul Aureus ERP through 1.6.0 allows unauthenticated remote attackers to retrieve de
Stored cross-site scripting in Webkul's Aureus ERP through version 1.6.0 allows an authenticated user holding permission
Webkul Aureus ERP through 1.6.0 fails to enforce sufficient password-strength requirements in the user creation/edit for
Exploit-DB