Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2025-56515 EUVD-2025-32705GHSA-2c6j-vw6r-mfch

Fiora chat group avatar is vulnerable to XSS via SVG files

Published Oct 1, 2025 · Updated Oct 1, 2025 · Assigned by mitre

Package: fiora Ecosystem: npm

Description

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers (onmouseover) to be uploaded and stored. When rendered, these SVG files execute arbitrary JavaScript, enabling attackers to steal user sessions, cookies, and perform unauthorized actions in the context of users viewing affected profiles.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Kov404/CVE-2025-56515 ★ 0 · Sep 30, 2025

    Cross-Site Scripting (XSS) Vulnerability in Fiora Chat Application

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm fiora 1.0.0 — GHSA-2c6j-vw6r-mfch

References