CVE-2026-97062

Executive Summary

CVE-2026-97062 is a stored cross-site scripting (XSS) vulnerability in Aureus ERP through version 1.6.0, where uploaded SVG files are stored on a public disk and served from the application's origin. Because SVG documents can embed JavaScript, an authenticated attacker can upload a malicious SVG that executes script in the application's origin when its URL is opened directly, enabling session cookie theft and CSRF token exfiltration. Any deployment of Aureus ERP at or below 1.6.0 that permits authenticated users to upload SVG files is affected, and no patch evidence currently exists from any tracked source.

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., cross-site scripting) and carries a CVSS v3.1 base score of 5.4. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N indicates a network-reachable flaw requiring low privileges and user interaction, with a scope change, low confidentiality impact, low integrity impact, and no availability impact.

The core mechanism is a mismatch between file storage and content handling. Aureus ERP stores uploaded SVG files on its public disk and serves them from the application origin. SVG is an XML-based format that supports embedded <script> elements and event handler attributes, so a file that appears to be an image can carry executable JavaScript. When the application returns such a file directly from its own origin rather than as a download or from a sandboxed/neutral origin, the browser treats the embedded script as same-origin content and executes it.

This defeats the usual assumption that uploaded images are inert. Two properties of the description are central: the files are placed on a public disk (broadly retrievable) and served from the application origin (same-origin execution context). Both are required for the impact described. Session cookies and CSRF tokens are the primary targets: script executing in the application's origin can read non-HttpOnly cookies and any CSRF token present in the DOM or readable response content, then transmit them to an attacker-controlled destination.

The precondition is that an authenticated user can upload an SVG file. The CVSS vector reflects this: PR:L (low privileges, one authenticated account) and UI:R (a victim must open the crafted file URL). The scope change (S:C) reflects that the vulnerable content handling crosses a trust boundary, allowing the injected script to affect resources beyond the immediate vulnerable component. Only limited technical detail is available regarding the exact upload endpoint or storage path; no specific function, parameter, or file path names are provided in the source data and none are asserted here.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-97062. The attack chain below is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker identifies an Aureus ERP instance at or below 1.6.0 that is reachable over the network and that accepts SVG uploads from authenticated users. Because the flaw is in the application rather than in a specific exposed service, discovery focuses on fingerprinting the ERP deployment. The Shodan dorks in the metadata can be used to locate candidate installations.

2. Triggering the flaw class. The attacker authenticates with a low-privileged account and uses the application's supported file-upload capability to submit an SVG file. The uploaded file is written to the public disk and made retrievable from the application origin. The trigger is not a malformed request but a legitimate upload of a file with an unsafe content type, which is precisely why the flaw is a stored XSS.

3. Payload / execution method. The SVG is crafted to contain JavaScript, for example within a <script> element or via an event-handler attribute, consistent with . The attacker then obtains the URL of the stored file and induces a victim — typically a higher-privileged user such as an administrator — to open that URL directly (UI:R). Because the file is served from the application origin, the browser executes the embedded script in that origin rather than treating the file as an inert image or a download.

4. Post-exploitation impact. Script running in the application origin can read session cookies that are not marked HttpOnly and can exfiltrate CSRF tokens, as stated in the description. Exfiltrated session material enables session hijacking; stolen CSRF tokens enable forged state-changing requests against the application under the victim's identity. The scope change in the CVSS vector reflects that this impact can extend to resources defended by the origin's session state.

Key limitations to note: exploitation requires an authenticated uploader and a victim who opens the file URL, so remote unauthenticated code execution is not implied by the available data. No exploit code or Nuclei template exists, and no in-the-wild activity is documented.

Impact Assessment

The business impact centers on account and session compromise within an ERP system, which typically holds finance, HR, inventory, and customer data. With CVSS 5.4, the severity is moderate: confidentiality and integrity impacts are each rated Low (C:L/I:L), availability is None (A:N), attack complexity is Low (AC:L), and the flaw requires low privileges (PR:L) plus user interaction (UI:R). The scope change (S:C) reflects that the injected script operates with the privileges of the application origin and can affect more than the vulnerable file-handling component alone.

Blast radius: every Aureus ERP deployment at or below 1.6.0 where authenticated users can upload SVG files. Because the payload is stored rather than reflected, a single malicious upload can persist and be used against multiple victims who view the file URL, widening the effective exposure beyond the original uploader. A low-privileged user can target administrative sessions, so the privilege asymmetry amplifies the practical risk despite the moderate base score. Availability is unaffected; the primary losses are unauthorized data access and unauthorized actions performed under a hijacked session. No EPSS score is available, and CISA KEV listing is absent, so likelihood cannot be quantified from those sources.

Detection Guidance

Sigma Rule

title: Aureus ERP Malicious SVG Upload - Stored XSS Attempt
id: 7f3c1a2e-9b4d-4c6a-8e2f-1d5a0b7c9e42
status: experimental
description: Detects uploads of SVG files to Aureus ERP through version 1.6.0, which may carry embedded JavaScript for stored XSS (CVE-2026-97062).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97062
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains:
      - '/upload'
      - '/file'
      - '/media'
  selection_svg:
    cs-uri-stem|endswith: '.svg'
  condition: selection_method and (selection_uri or selection_svg)
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate SVG uploads by developers or design staff
level: medium

YARA Rule

rule CVE_2026_97062_SVG_Stored_XSS
{
    meta:
        description = "Detects SVG files containing embedded JavaScript indicative of stored XSS targeting Aureus ERP (CVE-2026-97062)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97062"
        date = "2026-01-01"

    strings:
        $svg_open = "<svg" ascii nocase
        $script_open = "<script" ascii nocase
        $script_close = "</script>" ascii nocase
        $event_onload = /on[a-z]+[ ]*=/ ascii nocase
        $js_alert = "alert(" ascii nocase
        $js_cookie = "document.cookie" ascii nocase

    condition:
        $svg_open and (
            ($script_open and $script_close) or
            ($event_onload and any of ($js_*))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97062 Aureus ERP SVG Upload with Embedded Script XSS"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".svg"; nocase; http.request_body; content:"<svg"; nocase; http.request_body; content:"<script"; nocase; classtype:web-application-attack; reference:cve,2026-97062; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97062; sid:202697062; rev:1;)

Elastic Detection

file where event.action == "creation" and
  file.extension == "svg" and
  file.path : "*public*" and
  process.name != null

Splunk SPL Query

index=web sourcetype=access_combined
| search method=POST (uri_path="*.svg" OR uri_path="*/upload*" OR uri_path="*/media*")
| rex field=uri_path "(?<uploaded_ext>\.[a-zA-Z0-9]+)$"
| where uploaded_ext=".svg"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths by src_ip, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-97062,">
  <rule id="2026970" level="8">
    <if_sid>31100,31101,31108</if_sid>
    <id>^POST</id>
    <url>\.svg</url>
    <description>CVE-2026-97062: Possible malicious SVG upload to Aureus ERP (stored XSS vector)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list is available from the tracked data. The measures below are defensive guidance based on the vulnerability class, not vendor-issued remediations.

1. Immediate mitigations

• Block or restrict uploads of SVG files until the application can be patched; if SVG support is required, validate and sanitize uploaded content server-side.
• Serve all user-uploaded content from a separate origin (or a sandboxed domain) rather than the application origin, so any embedded script cannot run in the application's security context.
• Force uploaded files to download with Content-Disposition: attachment and a strict, non-renderable Content-Type, and send Content-Security-Policy headers that forbid inline script and restrict script sources.
• Mark session cookies HttpOnly (and Secure, SameSite) to reduce the impact of any successful script execution.

2. Patch / upgrade steps

• Monitor the vendor and the NVD entry for CVE-2026-97062 for an official fixed release; as of this writing there is no patch evidence from any tracked source.
• Once a fixed version is published, upgrade Aureus ERP above 1.6.0 and verify that uploaded content is no longer served from the application origin.

3. Long-term hardening

• Adopt an upload policy that validates file content against an allow-list of safe types and re-encodes or strips active content from images.
• Enforce a robust Content-Security-Policy across the application, combined with HttpOnly/SameSite session cookies and per-request CSRF tokens.
• Add server-side file-content scanning and routine review of public upload directories, and log and alert on SVG uploads as a persistent detection control.

References

• NVD — CVE-2026-97062: https://nvd.nist.gov/vuln/detail/CVE-2026-97062
• CWE-79 Improper Neutralization of Input During Web Page Generation: https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• OWASP Cross Site Scripting Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-97062 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-97062 at this time. No public PoC, exploit code, or Nuclei template is available, and the CVE is not listed in CISA KEV.