Summary
Payload versions with permissive local upload configurations may allow XML files and associated stylesheets to execute JavaScript in the Payload origin when opened by an authenticated user. An attacker who can place a crafted XML file in an accepted upload location could trigger stored cross-site scripting in the context of that user's session.
Payload versions with permissive local upload configurations may allow XML files and associated stylesheets to execute JavaScript in the Payload origin when opened by an authenticated user. An attacker who can place a crafted XML file in an accepted upload location could trigger stored cross-site scripting in the context of that user's session.
Affected context
The issue occurs in Payload deployments where local upload collections accept XML files and serve those files from the Payload origin. Risk is higher when an attacker can upload or otherwise store XML content and a logged-in user subsequently opens the file in a browser that processes its stylesheet.
The issue occurs in Payload deployments where local upload collections accept XML files and serve those files from the Payload origin. Risk is higher when an attacker can upload or otherwise store XML content and a logged-in user subsequently opens the file in a browser that processes its stylesheet.
Exploit preconditions
- Attack surface: Local file upload and file-serving functionality
- Required access: Ability to upload or store an XML file accepted by the affected collection, or access to another path that permits such content to be placed there
- Trigger point: An authenticated user opens the stored XML file
- Why exploitation is possible: XML and stylesheet content is served from a trusted application origin and can cause browser-executed script to run in that origin
- Attack surface: Local file upload and file-serving functionality
- Required access: Ability to upload or store an XML file accepted by the affected collection, or access to another path that permits such content to be placed there
- Trigger point: An authenticated user opens the stored XML file
- Why exploitation is possible: XML and stylesheet content is served from a trusted application origin and can cause browser-executed script to run in that origin
Why this happens
The underlying issue is insufficient restriction of uploaded XML content and its associated stylesheet behavior. When a file type capable of carrying active browser content is accepted and served from the application origin without adequate content isolation, uploaded data can be interpreted as executable client-side content. This maps to CWE-434: Unrestricted Upload of File with Dangerous Type and can result in stored cross-site scripting.
The underlying issue is insufficient restriction of uploaded XML content and its associated stylesheet behavior. When a file type capable of carrying active browser content is accepted and served from the application origin without adequate content isolation, uploaded data can be interpreted as executable client-side content. This maps to CWE-434: Unrestricted Upload of File with Dangerous Type and can result in stored cross-site scripting.
Potential impact
- JavaScript execution in the Payload origin
- Unauthorized actions performed through an authenticated user's browser
- Exposure of accessible application data or session-related information
- Modification of content or administrative settings available to the victim
- Phishing or further compromise of users who open the stored file
- JavaScript execution in the Payload origin
- Unauthorized actions performed through an authenticated user's browser
- Exposure of accessible application data or session-related information
- Modification of content or administrative settings available to the victim
- Phishing or further compromise of users who open the stored file
General mitigation guidance
Mitigation generally focuses on reducing the trust placed in uploaded file types and isolating user-controlled content.
Common defensive patterns include:
- Disallowing XML and other active document formats unless they are strictly required
- Applying allowlists based on validated content rather than filename or extension alone
- Serving user-uploaded files from a separate origin or strongly isolated content domain
- Enforcing safe response headers, suitable content types, and download-oriented handling where appropriate
- Sanitizing or transforming XML with secure parser settings when XML support is necessary
- Restricting upload and collection-management privileges according to least privilege
- Preventing uploaded content from inheriting administrative application-origin privileges
Mitigation generally focuses on reducing the trust placed in uploaded file types and isolating user-controlled content.
Common defensive patterns include:
- Disallowing XML and other active document formats unless they are strictly required
- Applying allowlists based on validated content rather than filename or extension alone
- Serving user-uploaded files from a separate origin or strongly isolated content domain
- Enforcing safe response headers, suitable content types, and download-oriented handling where appropriate
- Sanitizing or transforming XML with secure parser settings when XML support is necessary
- Restricting upload and collection-management privileges according to least privilege
- Preventing uploaded content from inheriting administrative application-origin privileges
How teams detect issues like this
Detection can include static analysis and configuration review for upload collections that allow XML, SVG, HTML, stylesheet, or other active document formats. Code review should examine filename-only validation, origin-sharing behavior, response headers, XML parsing, and whether uploaded content is rendered inline. Runtime monitoring can flag unusual XML uploads, access to uploaded files by privileged users, and unexpected script-capable content responses. Policy enforcement in CI or deployment checks can require approved file-type allowlists and isolated file-serving origins.
Detection can include static analysis and configuration review for upload collections that allow XML, SVG, HTML, stylesheet, or other active document formats. Code review should examine filename-only validation, origin-sharing behavior, response headers, XML parsing, and whether uploaded content is rendered inline. Runtime monitoring can flag unusual XML uploads, access to uploaded files by privileged users, and unexpected script-capable content responses. Policy enforcement in CI or deployment checks can require approved file-type allowlists and isolated file-serving origins.
