CVE-2026-104475: IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browsers when served from the /public route.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what access do they need?
An attacker needs an authenticated IDURAR ERP CRM account with access to the profile update or settings upload functionality. Exploitation requires uploading an SVG file containing JavaScript.
Who is exposed to the injected script?
Users whose browsers load the malicious SVG from the application's /public route are exposed. The supplied vector indicates the script executes in the victim's browser when that uploaded file is served.
Are default deployments affected?
The available information identifies affected versions through 4.1.1, but does not state whether SVG uploads are enabled in every default deployment. Exposure depends on whether authenticated users can reach the affected profile or settings upload endpoints and uploaded files are served from /public.
How can administrators check for possible exploitation?
Review files uploaded through profile update and settings upload functions, especially SVG files served from /public. Look for SVG content containing JavaScript or other active script constructs.