CVE-2025-61681: KUNO CMS Stored XSS Vulnerability

CVE-2025-61681 Overview

CVE-2025-61681 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in KUNO CMS, a full-stack blog application. Versions 1.3.13 and below fail to properly validate uploaded files. The upload endpoint relies solely on the Content-Type header, without inspecting file contents or enforcing an extension allow-list. Attackers can upload Scalable Vector Graphics (SVG) files containing embedded JavaScript disguised as images. When a user views the uploaded resource, the browser executes the attacker-controlled script in the site's origin. The maintainers addressed the issue in version 1.3.14.

Critical Impact
Authenticated attackers can upload malicious SVG payloads that execute arbitrary JavaScript in visitors' browsers, enabling session theft, credential harvesting, and administrative account takeover.

Affected Products

KUNO CMS versions 1.3.13 and below
KUNO CMS media upload component (frontend/src/components/admin/media-upload.tsx)
Fixed in KUNO CMS version 1.3.14

Discovery Timeline

2025-10-03 - CVE-2025-61681 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61681

Vulnerability Analysis

The flaw resides in the media upload handler in KUNO CMS. The server validates file types by inspecting the Content-Type header supplied by the client. Attackers control this header and can trivially set it to image/png while sending SVG content. The application lacks two additional controls: file content analysis (magic byte or MIME sniffing on server side) and an extension allow-list.

SVG is an XML-based image format that natively supports <script> elements and event handlers such as onload. When a browser renders the uploaded SVG directly, embedded JavaScript executes under the CMS origin. This produces a stored XSS condition affecting every visitor who loads the resource.

Root Cause

The root cause is improper input validation on file uploads. The upload endpoint trusts the client-supplied Content-Type header and never verifies the actual byte signature or file extension against a strict allow-list. This is a textbook instance of [CWE-79] combined with unrestricted file upload logic.

Attack Vector

Exploitation requires an attacker able to reach the media upload functionality and a victim who subsequently loads the uploaded resource. The attacker crafts an SVG containing an inline <script> block or event-handler payload, submits it via the upload endpoint with an image MIME type, and shares or references the returned resource URL. When any user opens the URL, the payload executes with the privileges of that user's session.

text

// Patch reference: frontend/src/components/admin/media-upload.tsx
  const getAcceptString = () => {
    switch (acceptedTypes) {
      case 'image':
-        return 'image/jpeg,image/jpg,image/png,image/gif,image/webp'
+        return 'image/jpeg,image/jpg,image/png,image/gif,image/webp,image/svg+xml'
      case 'video':
        return 'video/mp4,video/webm,video/ogg,video/avi,video/mov'
      default:
-        return 'image/jpeg,image/jpg,image/png,image/gif,image/webp,video/mp4,video/webm,video/ogg,video/avi,video/mov'
+        return 'image/jpeg,image/jpg,image/png,image/gif,image/webp,image/svg+xml,video/mp4,video/webm,video/ogg,video/avi,video/mov'
    }
  }

Source: GitHub Commit fc486b5. The v1.3.14 patch explicitly enumerates image/svg+xml while introducing server-side sanitization for SVG uploads.

Detection Methods for CVE-2025-61681

Indicators of Compromise

SVG files stored in the KUNO CMS media directory containing <script>, onload, onerror, or javascript: tokens.
HTTP POST requests to the media upload endpoint with Content-Type: image/* headers but SVG or XML byte signatures in the body.
Outbound requests from client browsers to attacker-controlled domains immediately after loading a media resource URL.

Detection Strategies

Scan the uploads directory for files with .svg extension or XML content and flag any containing script elements or event handlers.
Deploy web application firewall (WAF) rules that inspect uploaded file bodies and reject SVG payloads containing executable script content.
Correlate media upload events with subsequent DOM-based script executions observed in browser telemetry or Content Security Policy (CSP) violation reports.

Monitoring Recommendations

Enable CSP reporting endpoints and monitor script-src violations originating from media resource URLs.
Review web server access logs for anomalous upload volumes and requests referencing .svg resources from unexpected user agents.
Alert on new administrator sessions established shortly after media resources are viewed by privileged users.

How to Mitigate CVE-2025-61681

Immediate Actions Required

Upgrade KUNO CMS to version 1.3.14 or later without delay.
Audit the media directory for existing SVG files and remove any containing script content or unexpected event handlers.
Rotate administrator credentials and invalidate active sessions if malicious SVGs are found.

Patch Information

The fix is available in KUNO CMS Release v1.3.14. Technical details are documented in GitHub Security Advisory GHSA-q3w2-2vqp-gx3r and the corresponding commit fc486b5.

Workarounds

Block SVG uploads at the reverse proxy or WAF by rejecting requests whose bodies contain <svg or <script tokens.
Serve user-uploaded media from a separate sandboxed domain to isolate any executed script from the primary CMS session cookies.
Configure a strict Content Security Policy that disables inline scripts and restricts script-src to trusted origins.

bash

# Nginx example: force SVG downloads and disable inline execution
location ~* \.svg$ {
    add_header Content-Disposition "attachment";
    add_header Content-Security-Policy "default-src 'none'; script-src 'none'; style-src 'none'";
    add_header X-Content-Type-Options "nosniff";
}