CVE-2026-122095: XSS
AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting (XSS) vulnerability in the menu icon upload function. An authenticated user with ordinary application privileges can upload an SVG file containing embedded JavaScript, which is served from the application origin. Normal menu rendering uses an HTML <img> element and does not execute the SVG script; exploitation requires a victim to load the uploaded SVG as a document (by directly navigating to its URL, or via <object>/<iframe>), in which case the script executes under the application origin.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AsiaInfo BSS Platformto a version that resolves this vulnerability.Fixed in 9.2.38
Event History
Frequently Asked Questions
Who can upload a malicious SVG file?
An authenticated user with ordinary application privileges can use the menu icon upload function to upload an SVG containing embedded JavaScript.
Does normal menu rendering trigger the malicious script?
No. The application normally renders menu icons using an HTML img element, which does not execute the embedded SVG script.
What must happen for exploitation to succeed?
A victim must load the uploaded SVG as a document, either by directly navigating to its URL or by loading it through an object or iframe element. The script then executes under the application origin.
Which versions are affected?
AsiaInfo BSS Platform versions before 9.2.38 are affected.