Summary
Payload contains a stored cross-site scripting vulnerability in collections that permit downloadable SVG uploads. An attacker who can upload or replace an SVG may bypass sanitization, causing attacker-controlled JavaScript to execute when a user downloads and opens the file.
Payload contains a stored cross-site scripting vulnerability in collections that permit downloadable SVG uploads. An attacker who can upload or replace an SVG may bypass sanitization, causing attacker-controlled JavaScript to execute when a user downloads and opens the file.
Affected context
The issue occurs in Payload deployments where a collection:
- Accepts SVG files as uploads
- Makes those SVG files downloadable
- Relies on sanitization that does not fully remove executable content
Exploitation depends on a user downloading and opening the malicious SVG in a context where its script can execute.
The issue occurs in Payload deployments where a collection:
- Accepts SVG files as uploads
- Makes those SVG files downloadable
- Relies on sanitization that does not fully remove executable content
Exploitation depends on a user downloading and opening the malicious SVG in a context where its script can execute.
Exploit preconditions
- Attack surface: File upload and download functionality for SVG content
- Required access: Permission to upload or modify files in an affected collection
- Trigger point: A user downloads and opens the stored SVG
- Why exploitation is possible: The uploaded SVG can retain attacker-controlled script content after sanitization, and SVG files may be interpreted as active document content
- Attack surface: File upload and download functionality for SVG content
- Required access: Permission to upload or modify files in an affected collection
- Trigger point: A user downloads and opens the stored SVG
- Why exploitation is possible: The uploaded SVG can retain attacker-controlled script content after sanitization, and SVG files may be interpreted as active document content
Why this happens
The vulnerability results from insufficient sanitization of SVG uploads combined with treating user-provided SVG content as downloadable active content.
SVG is an XML-based format that can contain scripting and other browser-interpreted elements. When validation or sanitization fails to neutralize those elements, untrusted file content can execute in a user's browser, mapping to CWE-79: Improper Neutralization of Input During Web Page Generation. The upload aspect also relates to CWE-434: Unrestricted Upload of File with Dangerous Type.
The vulnerability results from insufficient sanitization of SVG uploads combined with treating user-provided SVG content as downloadable active content.
SVG is an XML-based format that can contain scripting and other browser-interpreted elements. When validation or sanitization fails to neutralize those elements, untrusted file content can execute in a user's browser, mapping to CWE-79: Improper Neutralization of Input During Web Page Generation. The upload aspect also relates to CWE-434: Unrestricted Upload of File with Dangerous Type.
Potential impact
- Attacker-controlled JavaScript may execute in a user's browser
- User sessions or accessible application data could be exposed
- Users may be redirected to deceptive content or phishing pages
- Administrative actions could be performed in the victim's context
- The application or its users could experience reputational and data-integrity harm
- Attacker-controlled JavaScript may execute in a user's browser
- User sessions or accessible application data could be exposed
- Users may be redirected to deceptive content or phishing pages
- Administrative actions could be performed in the victim's context
- The application or its users could experience reputational and data-integrity harm
General mitigation guidance
Mitigation generally focuses on reducing trust in uploaded SVG content and preventing active file types from being served in unsafe contexts.
Common defensive patterns include:
- Disallowing SVG uploads where vector graphics are not required
- Applying a strict, well-maintained SVG sanitization policy that removes scripts, event handlers, external references, and active elements
- Converting uploaded SVG files to a non-active image representation when feasible
- Serving user-uploaded files from an isolated origin with restrictive response headers
- Enforcing accurate content-type handling and download-oriented browser policies
- Restricting upload permissions and applying least privilege to collection roles
- Validating file content rather than relying only on filename extensions or client-provided MIME types
Mitigation generally focuses on reducing trust in uploaded SVG content and preventing active file types from being served in unsafe contexts.
Common defensive patterns include:
- Disallowing SVG uploads where vector graphics are not required
- Applying a strict, well-maintained SVG sanitization policy that removes scripts, event handlers, external references, and active elements
- Converting uploaded SVG files to a non-active image representation when feasible
- Serving user-uploaded files from an isolated origin with restrictive response headers
- Enforcing accurate content-type handling and download-oriented browser policies
- Restricting upload permissions and applying least privilege to collection roles
- Validating file content rather than relying only on filename extensions or client-provided MIME types
How teams detect issues like this
Detection approaches can include:
- Static analysis and code review checks for upload handlers that accept SVG without strict content validation
- Review signals showing direct storage or serving of user-controlled SVG files
- Tests that verify sanitization removes scripting, event handlers, embedded content, and external references
- Web application policies that flag active file types served from the primary application origin
- Monitoring upload activity for unusual SVG submissions, repeated sanitization failures, or unexpected content changes
- Automated security review tools that identify unsafe file-upload and client-side script handling patterns
Detection approaches can include:
- Static analysis and code review checks for upload handlers that accept SVG without strict content validation
- Review signals showing direct storage or serving of user-controlled SVG files
- Tests that verify sanitization removes scripting, event handlers, embedded content, and external references
- Web application policies that flag active file types served from the primary application origin
- Monitoring upload activity for unusual SVG submissions, repeated sanitization failures, or unexpected content changes
- Automated security review tools that identify unsafe file-upload and client-side script handling patterns
