Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-62418

CVE-2025-62418: bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG)

6.9

CVSS Score
3.1

Basic Information

CVE ID
CVE-2025-62418
GHSA ID
GHSA-fg89-g389-p346
EPSS Score
-
CWE
CWE-79
Published
10/16/2025
Updated
10/16/2025
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
bagisto/bagistocomposer<= 2.3.72.3.8

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the TinyMCE editor's image upload functionality. An authenticated attacker could upload a crafted SVG file with embedded JavaScript. The root cause was the lack of server-side validation on the uploaded file type.

The analysis of the fixing commit 7b6b1dd639a14e7053bb82ef2f971c1f533fdfab points to the packages/Webkul/Admin/src/Http/Controllers/TinyMCEController.php file as the location of the vulnerability.

The upload() method in this controller acts as the entry point for the file upload. It calls the storeMedia() method, which contains the core logic for processing and saving the file. Prior to the patch, the storeMedia() function did not properly validate the MIME type or file extension of the uploaded file, directly storing it on the server. This allowed an attacker to upload a malicious SVG file disguised as an image.

The patch introduces strict checks within storeMedia() to validate the file's MIME type against an allowlist and ensure the file extension matches the MIME type. Because the exploit is triggered by uploading a file through the endpoint handled by upload(), which in turn uses storeMedia() to process the file, both functions would appear in a runtime profile during exploitation.

Vulnerable functions

Webkul\Admin\Http\Controllers\TinyMCEController::upload
packages/Webkul/Admin/src/Http/Controllers/TinyMCEController.php
This function is the public endpoint that handles the file upload request from the TinyMCE editor. It calls the `storeMedia` function where the core of the vulnerability lies. As the entry point for the vulnerable operation, it would be present in any runtime profile of the exploit.
Webkul\Admin\Http\Controllers\TinyMCEController::storeMedia
packages/Webkul/Admin/src/Http/Controllers/TinyMCEController.php
This function is responsible for the file storage logic. Before the patch, it lacked proper validation of the uploaded file's MIME type and extension, allowing a malicious SVG file containing JavaScript to be uploaded and stored on the server. The patch adds strict validation to prevent this.

WAF Protection Rules

WAF Rule

### Summ*ry In ***isto v*.*.*, t** TinyM** im*** uplo** *un*tion*lity *llows *n *tt**k*r wit* su**i*i*nt privil***s (*.*. **min) to uplo** * *r**t** SV* *il* *ont*inin* *m****** J*v*S*ript. W**n vi*w**, t** m*li*ious *o** *x**ut*s in t** *ont*xt o* t

Reasoning

T** vuln*r**ility is * stor** *ross-Sit* S*riptin* (XSS) issu* in t** TinyM** **itor's im*** uplo** *un*tion*lity. *n *ut**nti**t** *tt**k*r *oul* uplo** * *r**t** SV* *il* wit* *m****** J*v*S*ript. T** root **us* w*s t** l**k o* s*rv*r-si** v*li**ti