Executive brief
Fiora is an open-source chat application that allows users to customize their profile with avatar images. The application fails to properly validate SVG file uploads, allowing attackers to upload malicious SVG files containing embedded JavaScript code. When other users view an attacker's profile, the malicious script executes in their browser, potentially stealing session cookies and enabling unauthorized actions on their behalf.
Technical details
The vulnerability exists in Fiora's avatar upload functionality (affected components: packages/server/src/routes/user.ts, packages/web/src/components/Avatar.tsx) due to insufficient validation of SVG file content. Attackers can craft SVG files containing foreignObject elements with embedded iframe tags and JavaScript event handlers (e.g., onmouseover="alert(document.cookie)"), bypassing client-side XSS protections. The attack requires authentication to upload the malicious avatar, but the exploit triggers automatically when any user views the attacker's profile, enabling theft of session cookies and unauthorized actions in the victim's session context. This is a stored XSS vulnerability since the malicious SVG is persisted and served to all viewers. No patch information is currently available in the advisory.
Affected products
- suisuijiang Fiora 1.0.0
Timeline
- 2025-10-01: disclosed
- 2025-10-01: advisory: GHSA-2c6j-vw6r-mfch published