Taclia Web Application Cross-Site Scripting Vulnerability

A stored Cross-Site Scripting (XSS) vulnerability has been identified in the Taclia web application, which is designed for managing small and medium-sized enterprises (PYMES) and freelancers. The issue arises because uploaded SVG images are not adequately sanitized, allowing attackers to embed malicious scripts within the SVG files. These compromised files can be associated with image profiles, stored on the server, and executed in the context of any user who accesses the affected resource.

Impact

Exploitation of this vulnerability allows for stored Cross-Site Scripting, where injected scripts are executed in the context of the user accessing the compromised resource.

Remediation

The Taclia team has fixed this vulnerability in the latest version of the application.