Executive brief
zhitan-ems is an equipment management system that allows users to upload files including SVG images. An attacker can upload a malicious SVG file containing embedded JavaScript code that executes in the browsers of other users who view the uploaded file, potentially stealing session tokens, credentials, or triggering unauthorized actions on behalf of victims.
Technical details
zhitan-ems 1.0.0 contains a stored cross-site scripting (XSS) vulnerability in the /equipmentFile/upload endpoint. The application fails to properly sanitize or validate SVG file uploads, allowing attackers to embed malicious JavaScript code within SVG files. When an authenticated or unauthenticated user uploads a crafted SVG file and other users subsequently view or interact with the equipment file, the embedded JavaScript executes in their browser context. This permits session hijacking, credential theft, malware distribution, or execution of unauthorized actions. The vulnerability requires user interaction (viewing the malicious SVG) but affects all users who access the uploaded content.
Affected products
- zhitan EMS 1.0.0
Timeline
- 2026-09-09: disclosed