CVE-2026-97062: Aureus ERP through 1.6.0 Stored XSS via SVG File Upload
Aureus ERP through 1.6.0 stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Aureus ERP user who can upload an SVG file can exploit it. Exploitation also requires a victim to open the uploaded SVG directly through its application-hosted URL.
What is the impact if a victim opens a malicious uploaded SVG?
JavaScript embedded in the SVG can execute in the application's origin. This can enable theft of the victim's session cookie and CSRF token, and may allow actions to be performed in the victim's authenticated context.
Are uploads stored in a way that makes this cross-site scripting issue reachable?
Yes. Affected versions store uploaded SVG files on the public disk and serve them from the same origin as the application, so opening the file URL directly can trigger the embedded script.