CVE-2025-13784: Yungifez Skuul XSS Vulnerability

CVE-2025-13784 Overview

CVE-2025-13784 is a cross-site scripting (XSS) vulnerability in the yungifez Skuul School Management System through version 2.6.5. The flaw resides in the SVG File Handler component reachable through the /dashboard/schools/1/edit endpoint. An authenticated attacker with high privileges can upload a crafted Scalable Vector Graphics (SVG) file containing embedded scripts. When another user views the file, the script executes in their browser context. The vendor was contacted before public disclosure but did not respond. A public proof-of-concept is available, increasing the likelihood of opportunistic exploitation.

Critical Impact
Authenticated attackers can inject persistent JavaScript through SVG uploads, enabling session theft and browser-based actions against other authenticated users of the school management portal.

Affected Products

yungifez Skuul School Management System versions up to and including 2.6.5
Deployments exposing the /dashboard/schools/{id}/edit administrative interface
Instances permitting SVG uploads through the school profile editor

Discovery Timeline

2025-11-30 - CVE-2025-13784 published to the National Vulnerability Database (NVD)
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2025-13784

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. The Skuul application accepts SVG file uploads through the school edit workflow without sanitizing embedded XML content. SVG is an XML-based image format that natively supports <script> elements and JavaScript event handlers such as onload and onmouseover. When the server stores the file and later serves it inline with a permissive Content-Type such as image/svg+xml, browsers render and execute any embedded scripts. The payload runs in the origin of the vulnerable application, granting attacker code access to session cookies, Document Object Model (DOM) content, and authenticated Application Programming Interface (API) actions.

Root Cause

The root cause is missing input validation and output sanitization on file uploads handled by the SVG File Handler. The application does not strip active content from SVG files, does not enforce a restrictive Content-Security-Policy, and does not force downloads with Content-Disposition: attachment. These missing controls together allow the browser to interpret uploaded files as executable documents.

Attack Vector

Exploitation requires a network-reachable Skuul instance and authenticated access with elevated privileges to the school edit page. The attacker uploads an SVG file containing JavaScript through the profile or logo field at /dashboard/schools/1/edit. When an administrator or other user renders the stored SVG, the embedded script executes with the victim's session context. See the public proof-of-concept gist and the VulDB record #333788 for technical details.

Detection Methods for CVE-2025-13784

Indicators of Compromise

SVG files uploaded to the Skuul media or school assets directory containing <script>, onload=, or javascript: strings
HTTP POST requests to /dashboard/schools/*/edit with multipart payloads and a Content-Type of image/svg+xml
Outbound browser requests from authenticated admin sessions to unfamiliar third-party domains shortly after viewing school profile pages

Detection Strategies

Inspect stored files under the Skuul uploads directory for SVG content containing executable XML nodes or event-handler attributes
Deploy web application firewall (WAF) rules that flag SVG uploads carrying <script>, <foreignObject>, or on*= handlers
Correlate administrator page views of edited school records with anomalous JavaScript execution or exfiltration traffic

Monitoring Recommendations

Log and alert on all file uploads processed by the /dashboard/schools/*/edit handler
Monitor HTTP responses that return user-uploaded content with a Content-Type of image/svg+xml and no Content-Disposition: attachment
Track authentication events and session identifier reuse from unexpected IP addresses following admin activity

How to Mitigate CVE-2025-13784

Immediate Actions Required

Restrict access to /dashboard/schools/*/edit to trusted administrators and enforce multi-factor authentication (MFA)
Disable SVG uploads in the Skuul school profile editor until a patched version is available
Audit existing SVG files stored by the application and remove any containing script tags or event handlers

Patch Information

As of the last NVD update on 2026-09-03, the vendor has not published a security advisory or patched release. No vendor advisory URLs are listed in the CVE record. Track the VulDB entry #333788 for updates and consider migrating away from unmaintained deployments.

Workarounds

Convert uploaded SVG files to rasterized formats such as PNG or JPEG on the server before storage
Serve user-uploaded files from a sandboxed origin and set Content-Disposition: attachment to prevent inline rendering
Apply a strict Content-Security-Policy header that blocks inline scripts and restricts script sources
Sanitize SVG content server-side using a library that removes <script>, <foreignObject>, and on* event attributes

bash

# Configuration example: nginx snippet to force download of SVG uploads
location ~* ^/uploads/.*\.svg$ {
    add_header Content-Disposition "attachment";
    add_header Content-Security-Policy "default-src 'none'; script-src 'none'";
    add_header X-Content-Type-Options "nosniff";
}