CVE-2025-54300: Quantum Manager XSS Vulnerability

CVE-2025-54300 Overview

CVE-2025-54300 is a stored cross-site scripting (XSS) vulnerability in the Quantum Manager component for Joomla, versions 1.0.0 through 3.2.0. The component's SVG upload feature fails to sanitize uploaded files, allowing an authenticated attacker with high privileges to store malicious script content within SVG images. When another user renders the file, the embedded script executes in that user's browser session. The flaw maps to CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
An attacker who uploads a crafted SVG can execute arbitrary JavaScript in the context of any Joomla user or administrator who views the file, enabling session theft, administrative action abuse, and downstream site compromise.

Affected Products

Quantum Manager for Joomla 1.0.0 through 3.2.0
Joomla installations using the Quantum Manager media component
Norrnext Quantum Manager extension

Discovery Timeline

2025-08-25 - CVE-2025-54300 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54300

Vulnerability Analysis

Quantum Manager is a media management component distributed by Norrnext for Joomla-based websites. The component exposes an upload workflow that accepts image files, including Scalable Vector Graphics (SVG). SVG is an XML-based format that permits inline <script> elements and JavaScript event handlers such as onload or onclick. Browsers execute this script when rendering the SVG inline.

The vulnerable code path stores SVG uploads without stripping executable XML nodes or JavaScript event attributes. Any script embedded in the SVG persists on the server and runs each time the media is loaded within an administrative view or public page. Because the exploitation vehicle is a static file, the payload survives caching layers and reaches every viewer.

Exploitation requires an authenticated account with upload permissions, but the impact extends to unauthenticated visitors who load the media. The attack changes the scope of the Joomla instance and can affect additional systems that trust the origin.

Root Cause

The root cause is missing input sanitization on file uploads. The component treats SVG as a benign image type and stores the raw XML content. It does not remove <script> tags, javascript: URIs, or event handler attributes, and it does not force a non-executable content type on retrieval.

Attack Vector

An attacker with authenticated access to the Quantum Manager upload interface submits an SVG file containing a JavaScript payload inside a <script> block or as an inline event handler. The payload is stored on the Joomla server. When an administrator or site visitor opens the file through the media browser or an embedded page, the browser parses the SVG and executes the attacker's JavaScript in the origin of the Joomla site. Refer to the Norrnext Security Overview for vendor guidance.

Detection Methods for CVE-2025-54300

Indicators of Compromise

SVG files uploaded through Quantum Manager that contain <script>, onload, onerror, or javascript: strings
New administrator or Super User accounts created shortly after SVG uploads
Session cookies for privileged Joomla users appearing in outbound HTTP requests to unfamiliar domains
Unexpected modifications to Joomla configuration, extensions, or templates following media file access

Detection Strategies

Scan the Joomla images/ directory and Quantum Manager storage paths for SVG files containing script tags or JavaScript event attributes.
Review web server access logs for POST requests to Quantum Manager upload endpoints followed by GET requests to .svg assets from administrative sessions.
Correlate authenticated upload activity with subsequent privilege changes in the Joomla #__users table.

Monitoring Recommendations

Alert on any SVG upload event where the file content matches patterns such as <script, onload=, or href="javascript:.
Monitor for outbound network connections initiated by administrator browsers immediately after loading the Joomla admin console.
Track changes to installed extensions, template files, and user roles to catch post-exploitation actions.

How to Mitigate CVE-2025-54300

Immediate Actions Required

Upgrade Quantum Manager to a version later than 3.2.0 as released by Norrnext.
Audit the media directory for existing SVG files and remove any that contain script content or event handlers.
Restrict Quantum Manager upload permissions to trusted administrator accounts only.
Rotate Joomla administrator credentials and invalidate active sessions if suspicious SVG uploads are found.

Patch Information

Norrnext distributes updated releases of Quantum Manager through its official channels. Consult the Norrnext Security Overview for the fixed version and release notes. Apply the vendor-supplied update through the Joomla Extensions Manager and verify the installed version after upgrade.

Workarounds

Disable SVG uploads in Quantum Manager configuration until the patched version is installed.
Add a web server rule that serves .svg files with Content-Type: text/plain or Content-Disposition: attachment to prevent inline script execution.
Deploy a Content Security Policy (CSP) that blocks inline scripts and restricts script sources on the Joomla site.
Sanitize existing SVG assets by stripping <script> elements and on* attributes before serving them.

bash

# Apache configuration example to force SVG downloads instead of inline rendering
<FilesMatch "\.svg$">
    Header set Content-Disposition "attachment"
    Header set Content-Security-Policy "default-src 'none'; script-src 'none'"
</FilesMatch>