CVE-2025-61183: 
PHP vulnerability analysis and mitigation

CVE-2025-61183 is a stored Cross-Site Scripting (XSS) vulnerability in VaahCMS v2.3.1, specifically within the storeAvatar() method of UserBase.php and the file upload logic in MediaController.php. It allows a remote, low-privileged attacker to upload a malicious SVG file containing embedded JavaScript to a publicly accessible, predictable path on the server. The vulnerability was disclosed on October 8, 2025, and affects VaahCMS versions up to and including 2.3.1 (Composer package webreinvent/vaahcms). It carries a CVSS v3.1 base score of 6.1 (Medium) (Github Advisory, Feedly).

The root cause (CWE-79) is improper neutralization of user-controlled input during web page generation. The critical flaw lies in a race condition: the upload() method in MediaController.php physically saves the uploaded file to disk via $request->file($input_file_name)->storeAs($request->folder_path, $upload_file_name) before any content or MIME-type validation is performed. This allows an attacker to upload an SVG file containing a <script> tag, control the filename, and have it persisted at a predictable public path (/storage/media/YYYY/MM/<filename>.svg) even when the backend returns {"success": false, "errors": ["Unable to decode input"]}. No cleanup of failed uploads occurs, leaving the malicious file permanently accessible (GitHub Issue, PoC Repo).

Successful exploitation enables persistent (stored) XSS: any user whose browser renders the malicious SVG — via a crafted link, <img>, or <object> tag — will execute the attacker-controlled JavaScript in their browser session. This can lead to session cookie theft, credential harvesting, keylogging, unauthorized actions performed on behalf of authenticated users, and redirection to malicious sites. Because the file is stored at a publicly accessible URL, the attack surface extends to any user of the application who can be socially engineered into accessing the link (Github Advisory, PoC Repo).

A public proof-of-concept repository and a detailed GitHub issue documenting the exploitation flow were published on October 8–9, 2025 (PoC Repo, GitHub Issue). The vulnerability requires only a low-privileged registered user account and user interaction (a victim must access the malicious SVG URL), lowering the practical barrier to exploitation. The EPSS score is approximately 0.055–0.091%, indicating a low but non-negligible probability of exploitation in the near term. No in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Obtain a low-privileged account: Register or obtain credentials for a standard user account on the target VaahCMS 2.3.1 instance.
2. Craft a malicious SVG payload: Create an SVG file (e.g., xss.svg) containing embedded JavaScript, such as <svg xmlns="http://www.w3.org/2000/svg"><script>alert(document.cookie)</script></svg>.
3. Upload via the vulnerable endpoint: Send a POST request to POST /backend/vaah/manage/media/upload, supplying the malicious SVG as the file parameter and controlling the folder_path and filename parameters to place the file in a predictable public directory.
4. Confirm file persistence: Even though the server may return {"success": false, "errors": ["Unable to decode input"]}, verify the file is saved at /storage/media/YYYY/MM/xss.svg by directly accessing the URL in a browser.
5. Deliver the payload: Share the public URL of the stored SVG with a victim via a crafted link, email, forum post, or by embedding it as an <img src="..."> or <object> tag in application content.
6. Achieve script execution: When the victim's browser renders the SVG, the embedded JavaScript executes in their session, enabling cookie theft, session hijacking, or other malicious actions (GitHub Issue, PoC Repo).

• Network: Unexpected POST requests to /backend/vaah/manage/media/upload with Content-Type: multipart/form-data containing .svg files; GET requests to /storage/media/YYYY/MM/*.svg from unusual or external IP addresses.
• File System: Presence of .svg files under public/storage/media/YYYY/MM/ containing <script> tags or JavaScript event handlers (e.g., onload, onerror); files persisting despite backend error responses.
• Logs: Web server access logs showing POST requests to the media upload endpoint followed by GET requests to the resulting SVG path from different IP addresses; application logs recording "Unable to decode input" errors alongside successful file write operations.
• Process/Application: Unexpected JavaScript execution errors or CSP violation reports in browser console logs referencing /storage/media/ paths (GitHub Issue, PoC Repo).

No patched version of VaahCMS has been released as of the advisory date; the GitHub Advisory Database lists "None" for patched versions for all releases up to and including 2.3.1 (Github Advisory). Recommended mitigations include: (1) Disable SVG uploads entirely in the application configuration as an immediate workaround; (2) Implement server-side MIME-type validation before file storage, rejecting files that do not match allowed image types; (3) Use an SVG sanitizer library such as enshrined/svg-sanitize for PHP to strip active content from SVG files; (4) Store uploaded files outside the web root and serve them through a secure proxy that enforces content-type headers; (5) Implement automatic cleanup of files that fail validation; and (6) Enable a Content Security Policy (CSP) header to restrict script execution (PoC Repo).

The vulnerability was reported by researcher Thaw Phone Nyo, who disclosed it via a GitHub issue on August 5, 2025, and published a detailed PoC repository upon CVE assignment on October 8, 2025 (GitHub Issue, PoC Repo). The VaahCMS vendor acknowledged the issue but indicated a fix was pending at the time of disclosure. A Bluesky post referencing the CVE was noted in threat intelligence feeds shortly after publication, suggesting minor community awareness. No significant mainstream media coverage or major security vendor commentary has been identified.