CVE-2026-75307

Deferred Deferred - Pending Action

Cross Site Scripting via SVG Upload in Zhitan-EMS

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: MITRE

Description

zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-75307

EUVD

EUVD-2026-75207

Affected Vendors & Products

Vendor	Product	Version / Range
zhitan	ems	1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The vulnerability is a Cross Site Scripting (XSS) issue in the zhitan-ems 1.0.0 software. It allows attackers to inject malicious scripts via SVG file uploads through the /equipmentFile/upload endpoint.

Detection Guidance

To detect this XSS vulnerability in zhitan-ems 1.0.0, check if SVG files are being uploaded to the /equipmentFile/upload endpoint. Monitor network traffic for POST requests to this path with SVG file attachments. Inspect server logs for unusual file uploads or script execution attempts in SVG content.

Impact Analysis

An attacker could exploit this to execute arbitrary JavaScript in a victim's browser when they view the uploaded SVG file. This could lead to theft of session cookies, account takeover, or defacement of web pages.

Compliance Impact

This XSS vulnerability could violate GDPR by exposing user data through script injection. For HIPAA, it may compromise protected health information if medical systems are affected. Both standards require protection against such attacks.

Mitigation Strategies

Immediately disable SVG file uploads in zhitan-ems 1.0.0 or restrict uploads to trusted sources only. Implement input validation to block malicious SVG content. Update to a patched version if available. Monitor for any signs of exploitation or unauthorized access.

Hi! I’m here to help you understand CVE-2026-75307. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70