VvvebJs: Stored Cross-Site Scripting via SVG file upload (CVE-2026-5615)

VvvebJs up to version 2.0.5 is vulnerable to stored cross-site scripting (XSS) via the upload of malicious SVG files. Attackers can embed JavaScript within an SVG file, which is subsequently executed in the browser of a victim who views the file. A proof-of-concept (PoC) exploit has been published publicly, increasing the risk of exploitation.

Attack Chain

1. Attacker crafts an SVG file containing embedded JavaScript payloads.
2. Attacker interacts with the VvvebJs upload interface to submit the crafted SVG file.
3. The application processes the multipart form-data request and saves the file to the web directory without sufficient sanitization.
4. The uploaded file becomes publicly accessible via a direct URL.
5. The attacker lures an authenticated user or administrator to navigate to the URL of the uploaded SVG file.
6. The victim's browser renders the SVG, triggering the execution of the embedded JavaScript in the context of the VvvebJs domain.

Impact

Successful exploitation allows for execution of unauthorized JavaScript in a victim's session, which may lead to account takeover, sensitive data theft, or unauthorized actions performed on behalf of the user.

Recommendation

1. Upgrade all VvvebJs instances to a version later than 2.0.5.
2. Implement strict server-side validation for file uploads to allow only non-executable formats and enforce strict MIME type checking.
3. Configure a robust Content Security Policy (CSP) to restrict the execution of inline scripts and unauthorized sources.
4. Sanitize SVG files upon upload using established security libraries before storing them on the server.
5. If possible, host user-uploaded files on a separate, sandboxed domain to limit the impact of XSS.