---
id: CVE-2026-97062
title: >-
  Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files
  on its public disk and serves them from the application origin, allowing
  authenticated users to upload malicious SVG files containing JavaScript
summary: >-
  Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files
  on its public disk and serves them from the application origin, allowing
  authenticated users to upload malicious SVG files containing JavaScript.
  Attackers can …
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: Webkul
product: Aureus ERP
affected:
  - aureus_erp <= 1.6.0
published: '2026-09-24'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T21:17:24.477'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97062'
references:
  - url: >-
      https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-97062
    label: disclosure@vulncheck.com
  - url: 'https://github.com/aureuserp/aureuserp/pull/1574'
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@leediay/stored-xss-via-svg-upload-aureuserp'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/aureus-erp-stored-xss-via-svg-file-upload
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@leediay/stored-xss-via-svg-upload-aureuserp'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-64818
    label: disclosure@vulncheck.com
  - url: 'https://github.com/aureuserp/aureuserp'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/aureuserp/aureuserp/blob/b33fa04643a936885f83b5ad39a62260ef27a7a0/plugins/webkul/support/src/Filament/Clusters/Settings/Pages/ManageBranding.php#L65-L84
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/aureuserp/aureuserp/blob/b33fa04643a936885f83b5ad39a62260ef27a7a0/plugins/webkul/support/src/Filament/Resources/CompanyResource/Schemas/CompanyForm.php#L196-L200
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-stored-xss-via-svg-file-upload
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.0021
epssPercentile: 0.11124
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-24T14:57:04.998484Z'
ingestedAt: '2026-09-24T14:44:21.328Z'
---

## Overview

Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.