Vulnerability · Published Oct 1, 2025 · Assigned by mitre
CVE-2025-56515
High 8.8
In plain English
A high-severity unrestricted file upload in the fiora package (npm). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers (onmouseover) to be uploaded and stored. When rendered, these SVG files execute arbitrary JavaScript, enabling attackers to steal user sessions, cookies, and perform unauthorized actions in the context of users viewing affected profiles.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | fiora | no fix listed | GHSA-2c6j-vw6r-mfch |
Affected products (as reported)
Weakness: CWE-434, CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H