CVE-2026-97062

medium

Description

Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.

References

https://www.vulncheck.com/advisories/aureus-erp-stored-xss-via-svg-file-upload

https://hackmd.io/@leediay/stored-xss-via-svg-upload-aureuserp

https://github.com/aureuserp/aureuserp/pull/1574

https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-64818

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85887

Details

Source: Mitre, NVD

Published: 2026-09-24

Updated: 2026-10-02

Risk Information

CVSS v2

Base Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 5.4

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Severity: Medium

CVSS v4

Base Score: 5.1

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Severity: Medium

EPSS

EPSS: 0.0021