CVE-2026-4175: Aureus ERP Chatter XSS Vulnerability

CVE-2026-4175 Overview

CVE-2026-4175 is a stored cross-site scripting (XSS) vulnerability in Aureus ERP up to version 1.3.0-BETA2. The flaw resides in the Chatter Message Handler component, specifically the content-text-entry.blade.php template within the plugins/webkul/chatter/resources/views/filament/infolists/components/messages/ directory. Attackers can manipulate the subject or body arguments to inject malicious script content that renders unsanitized in the application context. The attack is exploitable remotely and requires low privileges with user interaction. The issue is tracked under CWE-79 and fixed in commit 2135ee7efff4090e70050b63015ab5e268760ec8.

Critical Impact
Authenticated remote attackers can inject persistent JavaScript into ERP chatter messages, enabling session theft, credential harvesting, and unauthorized actions performed in the browser context of other users.

Affected Products

Aureus ERP versions up to and including 1.3.0-BETA2
Chatter Message Handler component (content-text-entry.blade.php)
Related Blade templates rendering unsanitized payload content (invoice mail templates, blog post views)

Discovery Timeline

2026-03-16 - CVE-2026-4175 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-4175

Vulnerability Analysis

The vulnerability stems from improper output encoding in Laravel Blade templates used by the Aureus ERP Chatter feature. The affected templates render the subject and body fields of chatter messages using Blade's unescaped output syntax {!! !!}, which bypasses Laravel's default HTML entity encoding. Any HTML or JavaScript supplied in these fields is rendered verbatim in the recipient's browser. Because chatter messages are persisted, the injected payload executes each time another authenticated user views the affected record. This creates a stored XSS condition reachable over the network with only low-privileged authenticated access.

Root Cause

The root cause is the use of {!! $payload['description'] !!} and {!! $record->content !!} constructs without prior HTML sanitization. Blade's {!! !!} directive intentionally emits raw, unescaped output and assumes the developer has already neutralized untrusted markup. No server-side sanitizer was invoked before rendering user-controlled chatter content.

Attack Vector

An authenticated user submits a chatter message containing crafted HTML in the subject or body argument. When any user — including administrators — opens the conversation, the browser parses the injected markup and executes attacker-controlled JavaScript in the application's origin.

php

// Patch diff: invoice.blade.php
    <div class="notification">
-        {!! $payload['description'] !!}
+        {!! str($payload['description'])->sanitizeHtml() !!}
    </div>

// Patch diff: view-record.blade.php (blogs)
    <p>
-        {!! $record->content !!}
+        {!! str($record->content)->sanitizeHtml() !!}
    </p>

Source: GitHub commit 2135ee7

Detection Methods for CVE-2026-4175

Indicators of Compromise

Chatter message records containing HTML tags such as <script>, <img onerror=>, <svg onload=>, or javascript: URIs in the subject or body columns.
Outbound requests from authenticated user browsers to unfamiliar domains shortly after viewing a chatter thread.
Unexpected session token reuse or administrative actions originating from user accounts that recently viewed messaging modules.

Detection Strategies

Run database queries against the chatter messages table searching for HTML control characters (<, >, onerror, onload) within message subject and body fields.
Enable Content Security Policy (CSP) report-only mode and review reports for inline-script violations originating from /chatter/ routes.
Review web server access logs for POST requests to chatter endpoints that contain encoded script payloads in form parameters.

Monitoring Recommendations

Monitor file integrity on Aureus ERP Blade template directories under plugins/webkul/chatter/ and plugins/webkul/blogs/ to detect tampering or rollback of the patch.
Alert on anomalous JavaScript execution patterns in the ERP origin, such as requests to attacker-controlled hosts initiated from authenticated sessions.
Track creation of new administrative users or permission changes that occur within a short window after a chatter message is viewed.

How to Mitigate CVE-2026-4175

Immediate Actions Required

Upgrade Aureus ERP to release v1.3.0-BETA1 or later, which contains commit 2135ee7efff4090e70050b63015ab5e268760ec8.
Audit existing chatter, blog, and invoice records for stored HTML payloads and purge or sanitize any unsafe content before exposing the platform to additional users.
Rotate session tokens and force re-authentication for users who may have viewed malicious chatter messages prior to patching.

Patch Information

The upstream fix is merged via pull request #939 and applied in commit 2135ee7. The patch replaces direct unescaped output with Laravel's str(...)->sanitizeHtml() helper across the affected Blade templates, ensuring user-supplied chatter content is filtered before rendering. Additional context is available in VulDB entry #351083.

Workarounds

Restrict access to the Chatter module to trusted users only, using application role-based access control until the upgrade is applied.
Deploy a web application firewall (WAF) rule blocking requests containing <script, onerror=, or javascript: in chatter form parameters.
Enforce a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins to reduce exploit impact.

bash

# Apply upstream patch and upgrade
git fetch origin
git checkout v1.3.0-BETA1
composer install --no-dev --optimize-autoloader
php artisan view:clear
php artisan config:cache