PT-2026-3547 · Sesami · Sesamie

Miguel Jiménez · Published 2026-01-20 · Updated 2026-01-20 · CVE-2025-41084

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Sesame web application (affected versions not specified)

Description A stored Cross-Site Scripting (XSS) issue exists in the Sesame web application because uploaded SVG images are not properly sanitized. This allows attackers to embed malicious scripts in SVG files. Exploitation occurs by sending a POST request with a malicious payload using the logo parameter to the ''/api/v3/companies//logo'' API endpoint. The malicious script is then stored on the server and executed when a user accesses the compromised resource.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-41084

Affected Products

Sesamie

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-41084 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-sesame-web-application · Note
• https://t.me/CVEtracker/42607 · Telegram Post
• https://twitter.com/CVEnew/status/2013551404070154676 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2013680122017038601 · Twitter Post