Security Flaw in WSO2 Publisher Portal Allows Malicious SVG File Uploads

CVE-2025-12544

What is CVE-2025-12544?

The WSO2 Publisher portal has a security flaw that fails to enforce adequate validation on uploaded SVG files. This allows users with the Publisher role to upload maliciously crafted SVG files, enabling the injection of harmful scripts. By exploiting this vulnerability, an attacker could redirect the victim's browser to a potentially harmful site, alter the web page's appearance, or collect sensitive information from the browser. While the impact of this exploit is mitigated by the httpOnly flag on session-related cookies, preventing session hijacking, the lack of proper validation poses a significant risk that could affect the integrity and security of the application.

References