CVE-2025-11655
BaseFortify
Publication date: 2025-10-13
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totaljs | flow | * |
| totaljs | cms | 10 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-11655 is a vulnerability in Total.js Flow's SVG File Handler component that allows attackers to upload SVG files containing malicious payloads without proper sanitization. These SVG files can include embedded scripts or onload events that execute when the file is rendered in a browser, leading to Stored Cross-Site Scripting (XSS) and Open Redirect attacks. The vulnerability enables attackers to remotely upload and store malicious SVG files that, when accessed, execute harmful actions such as redirecting users to attacker-controlled sites or executing malicious scripts. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to perform phishing attacks, redirect users to malicious websites, and execute malicious scripts within your application context. This compromises the confidentiality, integrity, and availability of your system by enabling unauthorized actions through stored XSS and open redirect attacks. It can lead to user credential theft, session hijacking, or distribution of malware via the compromised SVG files uploaded to your system. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can be performed by monitoring for suspicious SVG file uploads to the /admin/upload/ endpoint, especially files containing onload event handlers or embedded scripts. One can check the uploaded SVG files for malicious payloads such as onload attributes triggering redirects or script tags. For example, using command-line tools to inspect SVG files stored on the server: 1) List SVG files in the upload directory: `find /path/to/uploads -name '*.svg'` 2) Search for suspicious attributes in SVG files: `grep -r -i 'onload\|script\|window.location' /path/to/uploads/*.svg` Additionally, monitoring HTTP requests to the upload endpoint for multipart/form-data POST requests containing SVG files can help detect exploitation attempts. Reviewing web server logs for unusual POST requests to /admin/upload/ and subsequent access to uploaded SVG files may also assist in detection. [2, 1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting or disabling SVG file uploads in the /admin/upload/ endpoint to prevent malicious files from being uploaded. If SVG uploads are necessary, implement strict sanitization of SVG files to remove dangerous attributes such as onload event handlers and script tags before storing or serving them. Additionally, restrict access to the upload and files directories to authenticated and authorized users only. Monitoring and removing any previously uploaded malicious SVG files is also recommended. Since no official patch or update is available, consider replacing the affected Total.js Flow component or product with a secure alternative until a fix is released. [3, 2]