CVE-2025-56515

{
  "id": "CVE-2025-56515",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-01T16:15:53.217",
  "lastModified": "2026-11-05T23:10:00.150",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers (onmouseover) to be uploaded and stored. When rendered, these SVG files execute arbitrary JavaScript, enabling attackers to steal user sessions, cookies, and perform unauthorized actions in the context of users viewing affected profiles."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de carga de archivos en la aplicación de chat Fiora 1.0.0 a través de la funcionalidad de carga de avatares de usuario. La aplicación no valida el contenido de archivos SVG, permitiendo que archivos SVG maliciosos con elementos foreignObject incrustados que contienen etiquetas iframe y manejadores de eventos JavaScript (onmouseover) sean cargados y almacenados. Al renderizarse, estos archivos SVG ejecutan JavaScript arbitrario, lo que permite a los atacantes robar sesiones de usuario, cookies y realizar acciones no autorizadas en el contexto de los usuarios que visualizan perfiles afectados."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-01T15:48:47.084332Z",
          "id": "CVE-2025-56515",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:suisuijiang:fiora:1.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6F6B4D3B-443A-403D-A762-1D9AA0AB2BC7"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://fiora.suisuijiang.com/",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://github.com/Kov404/CVE-2025-56515/tree/main",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/yinxin630/fiora",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}