CVE-2026-97062 Webkul CVE debrief

Who should care

Defenders and administrators of Aureus ERP 1.6.0 should assess exposure and prioritize remediation to prevent potential unauthorized actions within the application. They should also implement additional security measures to prevent XSS attacks, review compensating controls for exposed systems, and track exceptions and retest remediated assets.

Why it matters

CVE-2026-97062 is a stored XSS vulnerability in Aureus ERP 1.6.0 that allows authenticated users to upload malicious SVG files containing JavaScript. Defenders and administrators should assess exposure, prioritize remediation, and implement additional security measures to prevent XSS attacks.

• Session cookie theft and exfiltration
• CSRF token exfiltration and potential exploitation
• Potential for unauthorized actions within the application
• Need for validation and sanitization of user-uploaded files

Technical summary

Aureus ERP 1.6.0 stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration. The vulnerability has a CVSS score of 5.1 and a medium severity. Defenders and administrators should assess exposure and prioritize remediation to prevent potential unauthorized actions within the application.

Defensive priority

Medium

Recommended defensive actions

• Review and update Aureus ERP to version 53ad76dd566f414f1773ec6513616fc2b9e251b5 or later
• Restrict file uploads to only allow trusted and validated files
• Implement additional security measures to prevent XSS attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the stored XSS vulnerability in Aureus ERP 1.6.0. The vulnerability allows authenticated users to upload malicious SVG files containing JavaScript, which can be executed when the file URL is opened directly. The source item provides additional information on the vulnerability, including patch and issue-tracking information. However, the exact scope of affected systems and potential impact on defenders is limited, requiring further verification and assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.