Vulnerability · Published Sep 24, 2026 · Assigned by VulnCheck

CVE-2026-97062Aureus ERP 1.6.0 Stored XSS via SVG File Upload

Medium 5.4

In plain English

A medium-severity cross-site scripting in Aureus ERP from Webkul. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 88.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.

Affected products (as reported)

Vendor	Product	Versions
Webkul	Aureus ERP	0 – through 1.6.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

Pull Request #1574 patch, issue-tracking
Researcher Disclosure (1)
Researcher Disclosure (2) technical-description, exploit
VulnCheck Advisory third-party-advisory