Kubysoft Stored Cross-Site Scripting Vulnerability via Uploaded SVG Images

A stored cross-site scripting vulnerability has been identified in Kubysoft, a cloud-based ERP software. This issue arises because uploaded SVG images are not adequately sanitized, allowing attackers to inject malicious scripts into the files. These tainted SVGs are then stored on the server and executed in the context of users who access the affected resource.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user accessing the compromised resource.

Remediation

The Kubysoft team has fixed this vulnerability in the latest version of the software.