Executive brief
Lenve VHR is a personnel management application used to manage employee information and avatars. An authenticated attacker can upload arbitrary file types (such as SVG files containing malicious scripts) through the avatar upload function, leading to stored cross-site scripting (XSS) attacks when the uploaded file is served by the application. This could allow attackers to steal employee credentials, perform unauthorized actions, or compromise the integrity of the system.
Technical details
This vulnerability is an unrestricted file upload flaw (CWE-434) in the FastDFSUtils.upload() function used by the /hr/userface endpoint. The component fails to validate file types, extensions, or MIME types, allowing authenticated users to upload files with arbitrary extensions (e.g., SVG images containing JavaScript). The attack requires authentication (login) and a direct HTTP request to the upload endpoint. If the uploaded file is served inline from FastDFS or a CDN, the malicious script executes in users' browsers, resulting in stored XSS. Remediation involves implementing file type whitelisting, validating magic bytes, and sanitizing SVG content to strip executable scripts.
Affected products
- Lenve VHR 1.0-SNAPSHOT
Timeline
- 2026-09-13: disclosed