CVE-2025-61681 Kuno is Vulnerable to Stored XSS Attack via SVG File Upload
Attackers can upload malicious SVG files to execute arbitrary JavaScript in victim browsers due to insufficient file validation in KUNO CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-61681?
CVE-2025-61681 is a medium-severity cross-site scripting vulnerability in xuemian168 kuno, published on 3 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
KUNO CMS is a fully deployable full-stack blog application. Versions 1.3.13 and below contain validation flaws in its file upload functionality that can be exploited for stored XSS. The upload endpoint only validates file types based on Content-Type headers, lacks file content analysis and extension whitelist restrictions, allowing attackers to upload SVG files containing malicious scripts (disguised as images). When users access the uploaded resource pages, arbitrary JavaScript executes in their browsers. This issue is fixed in version 1.3.14.
Which versions are affected by CVE-2025-61681?
How do I fix CVE-2025-61681?
No fix has been published for CVE-2025-61681 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-61681 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-61681 exists.
Sources
Also known as GHSA-q3w2-2vqp-gx3r.