CVE-2026-54380

Received Received - Intake

Stored XSS in VitaFit Cloud API via SVG Upload

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description

VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket. Attackers can exploit the application's failure to restrict scripts or force downloads for image/svg+xml content, causing the JavaScript to execute when a victim opens the file via direct browser navigation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-54380

Affected Vendors & Products

Vendor	Product	Version / Range
Shenzhen Shine Industrial Co., Ltd.	VitaFit	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

VitaFit cloud API before 2026-10-30 had a stored cross-site scripting (XSS) vulnerability. Authenticated attackers could upload SVG images with malicious JavaScript to a shared storage bucket. The application failed to restrict scripts or enforce safe handling for SVG files, allowing the JavaScript to execute when victims opened the file directly in a browser.

Detection Guidance

Check for unauthorized SVG files in shared storage buckets by searching for files with .svg extension and inspecting their content for embedded JavaScript. Review server logs for unusual file uploads or access patterns to SVG files.

Impact Analysis

An attacker could trick you into opening a malicious SVG file, leading to unauthorized actions on your behalf, data theft, or session hijacking. Since the attack requires authentication to upload files, the primary risk is to users who access shared storage and open untrusted SVG files.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face compliance penalties if user data is compromised through this exploit.

Mitigation Strategies

Restrict SVG file uploads to trusted sources only.
Configure the server to serve SVG files with Content-Disposition: attachment to prevent script execution in browsers.
Update VitaFit cloud API to version 2026-10-30 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-54380. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...