---
id: CVE-2026-97062
title: >-
  Aureus ERP through 1.6.0 stores uploaded SVG files on its public disk and
  serves them from the application origin, allowing authenticated users to
  upload malicious SVG files containing JavaScript
summary: >-
  Aureus ERP through 1.6.0 stores uploaded SVG files on its public disk and
  serves them from the application origin, allowing authenticated users to
  upload malicious SVG files containing JavaScript. Attackers can craft SVG
  files with scrip…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: Webkul
product: Aureus ERP
affected:
  - aureus_erp <= 1.6.0
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T15:18:00.963'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97062'
references:
  - url: 'https://github.com/aureuserp/aureuserp'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/aureuserp/aureuserp/blob/b33fa04643a936885f83b5ad39a62260ef27a7a0/plugins/webkul/support/src/Filament/Clusters/Settings/Pages/ManageBranding.php#L65-L84
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/aureuserp/aureuserp/blob/b33fa04643a936885f83b5ad39a62260ef27a7a0/plugins/webkul/support/src/Filament/Resources/CompanyResource/Schemas/CompanyForm.php#L196-L200
    label: disclosure@vulncheck.com
  - url: 'https://github.com/aureuserp/aureuserp/pull/1574'
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@leediay/stored-xss-via-svg-upload-aureuserp'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-stored-xss-via-svg-file-upload
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@leediay/stored-xss-via-svg-upload-aureuserp'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-24T14:57:04.998484Z'
ingestedAt: '2026-09-24T14:44:21.328Z'
---

## Overview

Aureus ERP through 1.6.0 stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.