CVE-2025-62793: eLabFTW SVG Upload XSS Vulnerability

CVE-2025-62793 Overview

eLabFTW is an open source electronic lab notebook used by research laboratories. The application served uploaded Scalable Vector Graphics (SVG) files inline under the application origin. Because SVG supports active content, an authenticated attacker can upload a crafted SVG that executes JavaScript when a victim views the file. The result is stored cross-site scripting (XSS) [CWE-79] within the eLabFTW origin. A victim who opens the SVG URL, or any page embedding it, can have their session hijacked, notebook data exfiltrated, or actions performed on their behalf. The maintainers fixed the issue in eLabFTW 5.3.0.

Critical Impact
Authenticated attackers can achieve stored XSS in the eLabFTW origin by uploading a malicious SVG, enabling session hijacking and unauthorized actions against other users.

Affected Products

eLabFTW electronic lab notebook versions prior to 5.3.0
Deployments serving user-uploaded attachments inline via the DownloadController
Any research environment relying on eLabFTW attachment sharing between users

Discovery Timeline

2025-10-27 - CVE-2025-62793 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62793

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the file-serving path of eLabFTW. The application accepted SVG uploads and returned them with an inline Content-Disposition and the image/svg+xml MIME type. Browsers render SVG documents as active content, meaning embedded <script> elements and event handlers execute in the context of the serving origin.

Because the SVG is served from the same origin as the eLabFTW application, script executed inside the SVG has access to session cookies, CSRF tokens, and the DOM of the authenticated user. This escalates a simple upload primitive into full account takeover of any user who opens the crafted file or a page that embeds it.

Exploitation requires low privileges (an authenticated user able to upload attachments) and user interaction (a victim viewing the SVG). The scope is changed because script executes in the browser origin of another user, extending impact beyond the attacker's account.

Root Cause

The root cause is an incomplete allowlist of MIME types considered safe to serve inline. The DownloadController treated image/svg+xml the same as static raster image formats, disregarding that SVG is an XML document capable of executing scripts. No Content Security Policy or sandboxed rendering path constrained the SVG at the browser boundary.

Attack Vector

An authenticated user uploads an SVG containing a <script> element or event handler such as onload. The attacker shares the resource, links to it in an experiment, or embeds it in a page other users will visit. When the victim requests the SVG URL, the server responds with the file rendered inline, triggering script execution under the eLabFTW origin.

php

// Security patch: src/Controllers/DownloadController.php
// The fix removes image/svg+xml from the inline-safe MIME allowlist,
// forcing SVG files to be downloaded rather than rendered.
             'image/jpeg',
             'image/png',
             'video/mp4',
-            'image/svg+xml',
             'text/plain',
         );
         if (!in_array($mime, $safeMimeTypes, true)) {

Source: elabftw commit 09b95e3

Detection Methods for CVE-2025-62793

Indicators of Compromise

Uploaded attachments with the .svg extension or image/svg+xml MIME type containing <script>, onload=, onclick=, or javascript: URI references.
HTTP responses from eLabFTW serving SVG content with Content-Disposition: inline before the upgrade to 5.3.0.
Unusual outbound requests originating from an authenticated user session shortly after viewing an SVG attachment.
New or modified user actions (experiment edits, permission changes) performed from an authenticated session without corresponding user activity.

Detection Strategies

Scan the eLabFTW uploads directory for SVG files and parse them for scripting constructs, event handlers, and external references.
Review web server access logs for GET requests to SVG attachments followed by anomalous API calls from the same session.
Alert on inline delivery of image/svg+xml responses from the eLabFTW hostname.
Correlate attachment upload events with subsequent session-token usage from unfamiliar IP addresses or user agents.

Monitoring Recommendations

Enable audit logging for file uploads, downloads, and permission changes within eLabFTW.
Forward web server and application logs to a centralized analytics platform for cross-session correlation.
Track failed and successful authentication events for accounts that interacted with SVG attachments.
Monitor for Content Security Policy violation reports if a CSP is deployed in front of eLabFTW.

How to Mitigate CVE-2025-62793

Immediate Actions Required

Upgrade eLabFTW to version 5.3.0 or later, where SVG files are forced to download instead of rendering inline.
Audit existing attachments for SVG files uploaded before the patch and review their contents for embedded scripts.
Invalidate active user sessions after upgrading to force reauthentication and revoke any hijacked tokens.
Rotate API keys and credentials that may have been accessible via the affected browser origin.

Patch Information

The fix is delivered in eLabFTW 5.3.0 via commit 09b95e3. The patch removes image/svg+xml from the $safeMimeTypes allowlist in src/Controllers/DownloadController.php, so SVG uploads are served with a download disposition rather than rendered inline. See the GitHub Security Advisory GHSA-rq98-8jh9-684f for the full advisory.

Workarounds

Restrict SVG uploads at a reverse proxy or web application firewall until the upgrade is completed.
Deploy a Content Security Policy that disables inline scripts and restricts script sources for the eLabFTW origin.
Serve uploaded files from a distinct sandbox domain so script execution cannot access the application session.
Limit upload privileges to trusted users and require review of shared attachments in high-sensitivity environments.

bash

# Example nginx rule to force download of SVG attachments as a stopgap
location ~* \.svg$ {
    add_header Content-Disposition "attachment" always;
    add_header X-Content-Type-Options "nosniff" always;
    types { application/octet-stream svg; }
}