Read the docs
TI-2025-38113 Aliases CVE-2025-61681

Kuno is Vulnerable to Stored XSS Attack via SVG File Upload

Priority MEDIUM 58CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution, Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434 and CWE-79.

Summary

KUNO CMS is a fully deployable full-stack blog application. Versions 1.3.13 and below contain validation flaws in its file upload functionality that can be exploited for stored XSS. The upload endpoint only validates file types based on Content-Type headers, lacks file content analysis and extension whitelist restrictions, allowing attackers to upload SVG files containing malicious scripts (disguised as images). When users access the uploaded resource pages, arbitrary JavaScript executes in their browsers. This issue is fixed in version 1.3.14.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00245 15th percentileScored 2026-11-07
Fix Fixed kuno (xuemian168): 1.3.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
xuemian168kunobefore 1.3.141.3.14Patch availableCNA
  • kuno Vendorxuemian168 Affected before 1.3.14 Fixed in 1.3.14 Patch available CNA

Remediation

  • Fix · CNA kuno (xuemian168) Fixed in 1.3.14

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-61681

References

Other 3

  • TI-2025-38161 Kuno CMS Vulnerable to Server-Side Request Forgery (SSRF) via Unsafe SVG Upload CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences