CVE-2025-12544
Received Received - Intake

Stored XSS in Publisher Portal via Malicious SVG Upload

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: WSO2 LLC

Description
The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the application. The security consequences include the ability for a malicious actor to redirect the victim's browser to an arbitrary website, modify the web page's UI, or retrieve information from the browser. However, the impact is mitigated as session-related sensitive cookies are protected with the httpOnly flag, preventing session hijacking.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2025-12544

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Authenticated Stored Cross-Site Scripting (XSS) vulnerability in WSO2 API Manager. It occurs because the Publisher portal does not properly validate uploaded SVG files. A user with the Publisher role can upload a malicious SVG file containing scripts, which are then stored and executed when rendered by the application.

Detection Guidance

Check for unauthorized SVG uploads in the Publisher portal by reviewing file upload logs and searching for SVG files with embedded scripts. Inspect network traffic for unexpected redirects or UI modifications. Use tools like grep to scan for suspicious SVG content in web directories.

Impact Analysis

An attacker could exploit this to redirect your browser to a malicious site, modify the web page's UI, or steal browser information. However, session hijacking is prevented because sensitive cookies are protected with the httpOnly flag.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized script execution in the browser. Malicious scripts might access or exfiltrate sensitive user data, violating data protection requirements. However, the risk is limited as session cookies are protected with httpOnly flags, reducing session hijacking risks.

Mitigation Strategies

Apply the latest patches or updates for WSO2 API Manager versions 4.2.0, 4.1.0, 4.0.0, 3.2.1, and 3.2.0. Restrict SVG uploads to trusted sources or disable SVG uploads entirely. Monitor for unusual activity in the Publisher portal and web traffic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-12544. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...