6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-61183

CVE-2025-61183: VaahCMS is vulnerable to XSS through its Avatar Upload endpoint

Cross-Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of UserBase.php

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-61183

CVE-2025-61183:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
webreinvent/vaahcms	composer	<= 2.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the user avatar upload functionality, which allows for a stored Cross-Site Scripting (XSS) attack. The analysis of the provided information, including the vulnerability description and the source code of UserBase.php, points to a two-stage attack.

First, the attacker uploads a malicious SVG file. The application fails to properly validate the file type and content, saving it to a publicly accessible location on the server. The vulnerability description indicates this happens at the /backend/vaah/manage/media/upload endpoint, which is likely handled by a MediaController.

Second, the attacker uses the URL of the uploaded malicious SVG and submits it to the functionality that updates the user's avatar. This action calls the storeAvatar function within WebReinvent\VaahCms\Models\UserBase.php. This function directly assigns the user-provided URL to the avatar_url property of the user model and saves it to the database. There is no sanitization or validation of the URL within this function, making it a sink for the malicious input.

When a victim's browser loads the attacker's profile, it fetches the URL of the malicious SVG from the avatar_url field and renders the image. This act of rendering the SVG file triggers the execution of the embedded JavaScript payload in the context of the victim's browser session.

Therefore, the storeAvatar function is identified as the key vulnerable function because it is responsible for persisting the malicious URL, which is the core of the stored XSS vulnerability. While the initial file upload is also flawed, storeAvatar is the function that directly leads to the persistent storage of the XSS payload link.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.