CVE-2025-41084
Stored XSS in Sesame via Unsanitized SVG Logo Upload
Publication date: 2026-01-20
Last updated on: 2026-01-20
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| unknown_vendor | sesame | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-41084 is a stored Cross-Site Scripting (XSS) vulnerability in the Sesame web application. It occurs because uploaded SVG images are not properly sanitized. Attackers can send a POST request to the '/api/v3/companies/<ID>/logo' endpoint using the 'logo' parameter to upload malicious SVG files containing embedded scripts. These scripts are then stored on the server and executed in the context of any user who accesses the compromised resource, potentially allowing script execution attacks. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious scripts in the context of users who access the compromised resource. This can lead to unauthorized actions, data theft, session hijacking, or other malicious activities performed on behalf of the user, potentially compromising user accounts and sensitive information. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for POST requests to the endpoint `/api/v3/companies/<ID>/logo` that include SVG files uploaded via the 'logo' parameter. Inspecting these SVG files for embedded scripts can help identify malicious payloads. Network monitoring tools or web application firewalls (WAF) can be configured to log or alert on such requests. Specific commands are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting or monitoring uploads of SVG files to the `/api/v3/companies/<ID>/logo` endpoint, implementing input validation and sanitization for uploaded SVG images, and applying strict access controls to limit who can upload logos. Since no patch or solution has been reported yet, monitoring and restricting potentially malicious uploads is critical. [1]