CVE-2026-75307: zhitan-ems XSS Vulnerability via SVG Upload

CVE-2026-75307 Overview

CVE-2026-75307 is a Cross-Site Scripting (XSS) vulnerability in zhitan-ems version 1.0.0. The flaw exists in the /equipmentFile/upload endpoint, which accepts Scalable Vector Graphics (SVG) files without sanitizing embedded scriptable content. An attacker can upload a crafted SVG file containing JavaScript payloads. When a victim retrieves or renders the file in a browser, the embedded script executes in the context of the application origin.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in victim browsers, enabling session hijacking, credential theft, and unauthorized actions within the zhitan-ems application.

Affected Products

zhitan-ems 1.0.0

Discovery Timeline

2026-09-09 - CVE-2026-75307 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-75307

Vulnerability Analysis

The zhitan-ems application exposes an upload endpoint at /equipmentFile/upload intended for equipment-related file attachments. The endpoint does not restrict SVG uploads or strip active content from them. SVG is an XML-based image format that permits <script> tags and event handler attributes such as onload. Browsers execute this content when the SVG is served with an image MIME type and rendered directly.

The issue maps to CWE-79: Improper Neutralization of Input During Web Page Generation and CWE-434: Unrestricted Upload of File with Dangerous Type. Because the payload is stored on the server and retrieved by other users, this is a stored XSS variant.

Root Cause

The upload handler fails to validate file content beyond extension or basic MIME checks. It does not sanitize SVG XML to remove <script> elements or JavaScript URI handlers. Uploaded files are then served with a content type that browsers render as active SVG, allowing embedded scripts to execute in the application origin.

Attack Vector

An attacker with upload privileges submits a malicious SVG file to /equipmentFile/upload. The SVG contains inline JavaScript inside <script> tags or event attributes. When an administrator or other authenticated user accesses the file URL, the browser parses the SVG and executes the payload. The script runs with the victim's session cookies and can exfiltrate tokens, perform CSRF-style actions, or pivot to further internal access. See the GitHub Vulnerability Issue #13 for reproduction details.

Detection Methods for CVE-2026-75307

Indicators of Compromise

SVG files stored on the server containing <script> tags, javascript: URIs, or on* event handler attributes.
HTTP POST requests to /equipmentFile/upload with Content-Type: image/svg+xml from unexpected user accounts or IP addresses.
Outbound HTTP requests originating from user browsers to attacker-controlled domains shortly after rendering equipment files.

Detection Strategies

Inspect stored file artifacts for XML content containing executable elements using YARA or grep patterns targeting <script, onload=, and xlink:href="javascript:.
Review web server access logs for POST activity against /equipmentFile/upload correlated with subsequent GET requests to the returned file paths.
Deploy Content Security Policy (CSP) violation reporting to surface unexpected inline script execution in application responses.

Monitoring Recommendations

Alert on file uploads where declared MIME type is image/svg+xml and file content contains XML script constructs.
Monitor authenticated sessions for anomalous API calls that follow SVG file access events.
Track privileged account activity that includes viewing equipment files uploaded by lower-privileged accounts.

How to Mitigate CVE-2026-75307

Immediate Actions Required

Restrict the /equipmentFile/upload endpoint to reject SVG files until sanitization is in place.
Audit existing equipment file storage and remove SVG files containing script elements or event handlers.
Force Content-Disposition: attachment on user-uploaded files so browsers download rather than render them.

Patch Information

No vendor patch has been published in the enriched CVE data. Track the upstream project and the GitHub Vulnerability Issue #13 for remediation updates. Until a fixed release is available, apply the workarounds below.

Workarounds

Sanitize uploaded SVG content server-side using a library such as DOMPurify with SVG profile enabled, stripping <script>, <foreignObject>, and event handler attributes.
Serve user-uploaded files from a sandboxed, cookie-less origin distinct from the application domain.
Enforce a strict Content Security Policy that disallows inline script execution and restricts script sources.
Convert accepted SVGs to raster formats (PNG or JPEG) on the server before storage or delivery.

bash

# Example nginx configuration to force download of SVG uploads
location /equipmentFile/ {
    add_header Content-Disposition "attachment";
    add_header X-Content-Type-Options "nosniff";
    add_header Content-Security-Policy "default-src 'none'; sandbox;";
}