CVE-2026-129140: paicoding 1.0.0 through 1.0.3 Stored XSS via SVG Image Upload
paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability in image upload because ImageServiceImpl.validateStaticImg accepts SVG files, which are then served from the site origin when local storage is used. Authenticated attackers can upload script-bearing SVG images that execute when victims view them, stealing the non-HttpOnly f-session cookie to hijack accounts.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of paicoding 1.0.0 through 1.0.3 that use local storage for uploaded images are exposed, because uploaded SVG files are served from the application’s own origin. Victims are exposed when they view an attacker-uploaded SVG image.
What does an attacker need to exploit it?
The attacker needs an authenticated account with permission to upload images and must persuade a victim to view a script-bearing SVG upload. Successful exploitation can steal the victim’s non-HttpOnly f-session cookie and enable account hijacking.
Does this affect every image-upload configuration?
The described condition specifically requires local storage, where the uploaded SVG is served from the site origin. The provided information does not establish impact for other storage configurations.