CVE-2026-54380: VitaFit Cloud API Stored XSS via SVG File Upload
VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket. Attackers can exploit the application's failure to restrict scripts or force downloads for image/svg+xml content, causing the JavaScript to execute when a victim opens the file via direct browser navigation.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure image/svg+xml files in the shared storage bucket so browsers cannot execute embedded JavaScript, by forcing downloads or otherwise restricting scripts.
Shared storage bucket image/svg+xml content handling = force downloads or restrict script execution
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated to the VitaFit cloud API and able to upload an SVG file to the shared storage bucket. Exploitation also requires a victim to open the uploaded SVG through direct browser navigation.
What conditions make the uploaded SVG execute script?
The issue occurs when SVG content is served as image/svg+xml without restricting embedded scripts or forcing the browser to download the file. Under those conditions, malicious JavaScript in an uploaded SVG can execute in the victim's browser.
Which deployments are affected?
The affected scope is VitaFit cloud API versions before 2026-10-30. The provided information does not identify configuration-specific exceptions or confirm whether every default deployment is affected.