Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
webkul:aureus erp
References 8
https://github.com/aureuserp/aureuserp/pull/1574
Pull Request #1574
https://hackmd.io/@leediay/stored-xss-via-svg-upload-aureuserp
NVD
https://github.com/aureuserp/aureuserp/blob/b33fa04643a936885f83b5ad39a62260ef2…
NVD
https://github.com/aureuserp/aureuserp/blob/b33fa04643a936885f83b5ad39a62260ef2…
NVD
https://github.com/aureuserp/aureuserp
NVD
https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-stored-xss-via-sv…
VulnCheck Advisory: Aureus ERP through 1.6.0 Stored XSS via SVG File Upload
https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-64818
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/aureus-erp-stored-xss-via-svg-file-upload
disclosure@vulncheck.com