Eveo URVE Smart Office contains a stored XSS vulnerability allowing low-privileged…
Eveo URVE Smart Office contains a stored XSS vulnerability allowing low-privileged attackers to execute malicious code via SVG uploads; patched in version 1.1.24.
CERT Polska coordinated disclosure of CVE-2025-10348, a stored cross-site scripting vulnerability in Eveo URVE Smart Office software. The flaw exists in the report problem functionality, where an authenticated attacker with low privileges can upload a specially crafted SVG file containing malicious JavaScript. When a victim accesses the URL of the uploaded resource, the payload executes in their browser context.
The vulnerability is particularly concerning because the uploaded resource remains publicly accessible without requiring authentication, expanding the potential victim pool beyond authenticated users of the system. This allows an attacker to weaponize the XSS for credential theft, session hijacking, or further compromise of users interacting with the affected URVE Smart Office instance.
The vendor has addressed this issue in version 1.1.24. Organizations running earlier versions of URVE Smart Office should prioritize upgrading to the patched release. The vulnerability was responsibly reported by security researchers from Alior Bank and coordinated through CERT Polska's CVD process.
Mentioned in this report
Detection guidance
SVG File Upload Containing Embedded Script Tag
Detects upload of an SVG file whose body contains an inline <script> element, consistent with stored XSS payload delivery via SVG upload functionality (CVE-2025-10348). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SVG File Upload Containing Embedded Script Tag
id: 23ca9f3b-7523-556e-b7f5-22eb749fd95e
status: experimental
description: Detects HTTP requests uploading an SVG resource whose body contains an
embedded <script> element, a pattern used to smuggle JavaScript for stored XSS via
SVG upload features such as those exploited in CVE-2025-10348.
references:
- CVE-2025-10348
logsource:
category: proxy
detection:
selection:
cs-method: POST
c-uri|contains|all:
- .svg
http.request.body.content|contains: <script
filter_static_asset:
c-uri|contains:
- /static/
- /assets/
- /icons/
condition: selection and not filter_static_asset
falsepositives:
- Legitimate SVG icon libraries or design tools that embed inline script for interactive
graphics
- Automated vulnerability scanners submitting test SVG payloads during authorized
testing
level: medium
tags:
- attack.T1189
- cve.2025-10348
author: Vorant
Web Response Serving SVG Resource With Embedded JavaScript
Detects an HTTP response delivering an SVG resource whose content includes an inline <script> tag, indicating the resource was previously stored with an embedded XSS payload that will execute JavaScript in the requesting browser's context. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Response Serving SVG Resource With Embedded JavaScript
id: 37cfe596-ed96-5844-ac08-112c53769b0d
status: experimental
description: Detects an HTTP response for an SVG resource whose body contains an embedded
<script> element, indicating a stored XSS payload (e.g. uploaded via a vulnerable
report/upload feature such as CVE-2025-10348) is being served to and executed by
a victim browser.
references:
- CVE-2025-10348
logsource:
category: proxy
detection:
selection:
c-uri|contains: .svg
http.response.mime_type: image/svg+xml
http.response.body.content|contains: <script
condition: selection
falsepositives:
- Legitimate interactive SVG assets that intentionally embed script for animation
or UI behaviour
- Internal design/CMS tools that generate SVGs with inline scripting for legitimate
functionality
level: medium
tags:
- attack.T1059.007
- cve.2025-10348
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/10/CVE-2025-10348
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free