CVE-2026-97062CWE-79cross-site-scripting

CVE-2026-97062

Medium · published September 24, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
10.6
In the wild
Unconfirmed
What it is

Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00210 · 10.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-24T18:18Z
References (5)
https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-97062 · [email protected]https://github.com/aureuserp/aureuserp/pull/1574 · [email protected]https://hackmd.io/@leediay/stored-xss-via-svg-upload-aureuserp · [email protected]https://www.vulncheck.com/advisories/aureus-erp-stored-xss-via-svg-file-upload · [email protected]https://hackmd.io/@leediay/stored-xss-via-svg-upload-aureuserp · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 26 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 24 SEP 13:52Z
    Aureus ERP through 1.6.0 Stored XSS via SVG File Upload
    cvelistv5