PT-2025-40256 · Fiora · Fiora

Kaio Mendonça Pereira · Published 2025-10-01 · Updated 2025-10-06 · CVE-2025-56515

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fiora chat application versions 1.0.0 through 1.0.0

Description The Fiora chat application has a file upload issue related to the user avatar upload functionality. The application does not properly validate SVG file content. This allows malicious SVG files, containing foreignObject elements with iframe tags and JavaScript event handlers like onmouseover, to be uploaded and stored. When these SVG files are rendered, they execute arbitrary JavaScript. This can lead to the theft of user sessions and cookies, and enable attackers to perform unauthorized actions within the context of users viewing affected profiles.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

XSS

Unrestricted File Upload

Weakness Enumeration

CWE-79

CWE-434

Related Identifiers

CVE-2025-56515

GHSA-2C6J-VW6R-MFCH

Affected Products

Fiora

References · 9

• 🔥 https://github.com/Kov404/CVE-2025-56515/tree/main · Exploit
• https://osv.dev/vulnerability/CVE-2025-56515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-56515 · Security Note
• https://osv.dev/vulnerability/GHSA-2c6j-vw6r-mfch · Vendor Advisory
• https://github.com/yinxin630/fiora · Note
• https://t.me/CVEtracker/33855 · Telegram Post
• https://twitter.com/cracbot/status/1975154127874228554 · Twitter Post
• https://twitter.com/CVEnew/status/1973429144244363384 · Twitter Post
• https://fiora.suisuijiang.com · Note