Aureus ERP through version 1.6.0 stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.

The affected product is Webkul’s Aureus ERP. All releases up to and including version 1.6.0 are vulnerable; newer releases are believed not to be affected unless explicitly documented otherwise.

The CVSS score of 5.1 indicates a medium severity. The EPSS score is 0.00218 (0.218%), indicating a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Because an attacker must first authenticate to the system and then upload a crafted SVG, the threat requires legitimate user credentials and physical file upload access, but once achieved the script execution in the application’s origin can lead to credential theft and CSRF token exfiltration.