PT-2026-8326 · Kubysoft · Kubysoft

Published 2026-02-16 · Updated 2026-03-09 · CVE-2025-59903

Positive Technologies · (AI Summary)

CVSS v3.1

5.4

Medium

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kubysoft (affected versions not specified)

Description A stored Cross-Site Scripting (XSS) issue exists in Kubysoft due to inadequate sanitization of uploaded SVG images. This allows attackers to embed malicious scripts within SVG files, storing them on the server. When a user accesses the compromised resource, the malicious script executes in the user's context. The issue involves the upload mechanism for SVG images.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-59903

Affected Products

Kubysoft

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-59903 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-kubysoft · Note
• https://t.me/cveNotify/154866 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2023362533839552518 · Twitter Post
• https://t.me/cveNotify/152105 · Telegram Post
• https://twitter.com/CVEnew/status/2023353807447478340 · Twitter Post