CVE-2026-97062: Aureus ERP XSS Vulnerability

CVE-2026-97062 Overview

CVE-2026-97062 is a stored cross-site scripting (XSS) vulnerability affecting Aureus ERP versions up to and including 1.6.0. The application stores uploaded Scalable Vector Graphics (SVG) files on its public disk and serves them from the application origin. Authenticated users can upload SVG files containing embedded <script> elements. When another user opens the file URL directly, the script executes within the application's security origin.

Critical Impact
Successful exploitation enables session cookie theft and Cross-Site Request Forgery (CSRF) token exfiltration, allowing attackers to impersonate victims and perform actions on their behalf.

Affected Products

Aureus ERP versions through 1.6.0
Webkul Support plugin (ManageBranding page)
Company branding and logo upload components

Discovery Timeline

2026-09-24 - CVE-2026-97062 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-97062

Vulnerability Analysis

The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. Aureus ERP accepts SVG uploads through company branding workflows, including logo and favicon fields exposed by the ManageBranding page and the CompanyForm schema. Uploaded files are written to a publicly accessible disk and served from the same origin as the application. Because SVG is an XML-based format that can contain <script> elements and inline event handlers, the browser executes any embedded JavaScript when a user navigates to the file URL. The script runs with the privileges of the viewing user in the application's origin.

Root Cause

The root cause is the absence of content sanitization and inadequate response headers for user-uploaded SVG content. The application does not strip script content from SVG files prior to storage. It also serves these files from the primary application domain rather than a sandboxed or cookie-less origin. No Content-Security-Policy or Content-Disposition: attachment header is applied to force download or constrain script execution.

Attack Vector

An authenticated attacker with permission to modify branding uploads a crafted SVG file containing a <script> element that reads document.cookie and reads CSRF tokens from the Document Object Model (DOM). The attacker then shares or triggers navigation to the file URL on the public disk. When a victim loads the URL, the script executes in the Aureus ERP origin and exfiltrates session cookies and CSRF tokens to an attacker-controlled endpoint. The attacker can then hijack the session or forge authenticated state-changing requests.

Synthetic exploit code is not reproduced here. Refer to the HackMD XSS Analysis and the VulnCheck Advisory on Stored XSS for the full technical write-up.

Detection Methods for CVE-2026-97062

Indicators of Compromise

SVG files on the public storage disk containing <script>, onload, onerror, or <foreignObject> elements.
Outbound HTTP requests from browsers to unfamiliar domains immediately after loading an Aureus ERP branding asset URL.
Unexpected modifications to company branding, logos, or favicons by low-privilege user accounts.
Session reuse from geographically distant IP addresses following a branding asset upload.

Detection Strategies

Scan the Aureus ERP public storage directory for SVG files and parse them for script-capable XML nodes.
Inspect web server access logs for direct requests to .svg assets referenced from external referrers.
Review audit trails on the ManageBranding page and CompanyForm resource for upload actions performed by non-administrative accounts.
Correlate SVG upload events with subsequent authentication or CSRF-protected endpoint activity from the same session.

Monitoring Recommendations

Enable file integrity monitoring on the application's public upload directory.
Alert on HTTP responses that serve image/svg+xml content without a Content-Disposition: attachment header.
Monitor browser Content Security Policy (CSP) violation reports for inline script execution on asset paths.
Track and alert on anomalous session token usage patterns following SVG asset retrieval.

How to Mitigate CVE-2026-97062

Immediate Actions Required

Restrict SVG uploads to administrative roles only, or disallow the SVG MIME type entirely in branding components.
Sanitize all existing SVG files on the public disk and remove any containing script elements or event handlers.
Rotate active session cookies and CSRF tokens if indicators of exploitation are present.
Apply the fix included in GitHub Pull Request #1574 once merged into a release.

Patch Information

The maintainers have addressed the issue in GitHub Pull Request #1574 in the aureuserp/aureuserp repository. Administrators running Aureus ERP 1.6.0 or earlier should upgrade to a release that includes this change. Review the affected code paths in ManageBranding.php and CompanyForm.php to confirm the patch is applied in your deployment.

Workarounds

Serve all user-uploaded content from a separate, cookie-less domain to isolate script execution from the application origin.
Add a Content-Security-Policy response header that disallows inline scripts for asset paths.
Configure the web server to return Content-Disposition: attachment for SVG files so browsers download rather than render them.
Convert uploaded SVG files to raster formats (PNG, JPEG) server-side before storing them on the public disk.

bash

# Example Nginx configuration to force SVG download and set CSP on upload paths
location ~* ^/storage/.*\.svg$ {
    add_header Content-Disposition "attachment";
    add_header Content-Security-Policy "default-src 'none'; script-src 'none'; style-src 'none'";
    add_header X-Content-Type-Options "nosniff";
}