Executive brief
Fiora is a web-based chat application. An attacker can upload a malicious SVG image as their user avatar; when other users view the attacker's profile, the SVG executes arbitrary JavaScript in their browser. This allows account takeover, session hijacking, or theft of private messages.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in how Fiora handles user avatar uploads. SVG files are not properly sanitized before being rendered in the browser, allowing embedded JavaScript to execute in the context of any user viewing the avatar. The attack requires the attacker to upload a crafted SVG file as their avatar (requires authentication), and succeeds when other authenticated users view the attacker's profile. An attacker can steal session cookies, capture keystrokes, or perform actions on behalf of affected users. The issue affects Fiora 1.0.0 and likely other 1.x versions.
Affected products
- Yinxin630 Fiora 1.0.0, 1.x
Timeline
- 2025-10-01: disclosed