osuuu LightPicture Stored Cross-Site Scripting Vulnerability in SVG File Upload Handler

A stored cross-site scripting vulnerability has been identified in osuuu LightPicture versions through 1.2.2. The issue resides in the SVG file upload feature of the API, where the application fails to properly sanitize uploaded SVG files. This lack of validation allows for the execution of embedded JavaScript in the context of the user's browser when the image is viewed. The vulnerability can be exploited remotely by uploading a maliciously crafted SVG file via the upload API.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded SVG files containing JavaScript payloads are executed in the context of the user viewing the image.

Reproduction

To reproduce this vulnerability, upload an SVG file through the '/api/upload' endpoint. The SVG file must contain a script element with JavaScript code, such as an alert. After uploading, the SVG file will be accessible via a generated URL, and the embedded JavaScript will execute when the file is viewed.