Gửi #942850: SveltyCMS 0.0.6 Cross Site Scripting

Summary
A stored cross-site scripting (XSS) vulnerability in media upload allows any low-privileged (guest) user to gain full administrator privileges. By uploading an SVG image larger than a fixed threshold, the SVG content bypasses the built-in sanitizer and stores an unsanitized payload on the server. The payload executes in the browser of any user who later views the file (typically an administrator), enabling the attacker to take over the session and create an administrator account.

Details
Uploaded SVG files are sanitized (scripts, event handlers, foreignObject are stripped) before storage — but only for files smaller than 5 MB. Files at or above this size take a separate streaming upload path that never applies the sanitizer (src/utils/media/media-service.server.ts). The full SVG document is stored on disk and later served as an image/svg+xml document, so any inline script is executed in the viewer's session when the file is opened.

The vulnerability is exploitable by any authenticated guest user because the upload path used is reachable without elevated media permissions.

PoC
As a guest user, craft an SVG containing JavaScript, padded so the file exceeds the 5 MB sanitizer threshold.
Upload the file through the standard authenticated media/avatar upload flow.
When an administrator opens or previews the stored file, the script runs in the administrator's authenticated session and creates a new user with the admin role using attacker-controlled credentials.
The attacker logs in with those credentials and gains full administrator access.

Impact
Type: Stored cross-site scripting (XSS) leading to privilege escalation (guest → administrator).
Severity: High/Critical.
Who is affected: Any deployment accepting guest/community uploads. The attacker's session is a normal guest account; the victim is any authenticated user who views the malicious media (most impactfully an administrator). Impact includes full account takeover, persistent backdoor access via a newly minted admin account, and access to all CMS data and configuration.

• Nguồn: ⚠️ https://github.com/SveltyCMS/SveltyCMS/commit/05b4f9efeb79e9d72a693232334d7529687f896f
• Người dùng: HLever (UID 100450)
• Đệ trình: 22/08/2026 00:17 (cách đây 28 ngày)
• Kiểm duyệt: 18/09/2026 10:27 (27 days later)
• Trạng thái: được chấp nhận
• Mục VulDB: 407422 [SveltyCMS 0.0.6 SVG Media Upload media-service.server.ts Tập lệnh chéo trang]
• điểm: 20