Full Report
Cross-site Scripting vulnerability (CVE-2025-10348) has been found in Eveo URVE Smart Office software.
Analysis Summary
# Vulnerability: Stored Cross-Site Scripting in Eveo URVE Smart Office via SVG Upload
## CVE Details
- CVE ID: CVE-2025-10348
- CVSS Score: Not explicitly provided (Must be estimated, likely High due to Stored XSS and unauthenticated access, but reported as medium/high impact based on context)
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation (XSS))
## Affected Systems
- Products: Eveo URVE Smart Office software
- Versions: All versions before 1.1.24
- Configurations: Vulnerable when utilizing the report problem functionality that allows file upload.
## Vulnerability Description
The Eveo URVE Smart Office software suffers from a Stored Cross-Site Scripting (XSS) vulnerability within its "report problem" functionality. An attacker, even with a low-privileged account, can upload an SVG file containing a malicious payload. This payload is executed when an unauthenticated victim visits the URL pointing to the uploaded resource, as the resource appears to be accessible publicly without authentication checks.
## Exploitation
- Status: PoC available (Implied by responsible disclosure structure, though not explicitly stated as "publicly available")
- Complexity: Low (Requires only low-privileged account access for upload)
- Attack Vector: Network
## Impact
- Confidentiality: High (Script execution can lead to session hijacking or data exfiltration)
- Integrity: High (Script execution allows modification via attacker-controlled content)
- Availability: Low to Medium (Dependent on the specific payload)
## Remediation
### Patches
- Fixed in version: 1.1.24
### Workarounds
- No specific workarounds were provided in the source material. Users should prioritize upgrading. If immediate upgrade is impossible, restrict file upload capabilities in the report problem feature if possible.
## Detection
- Indicators of compromise: Look for unusual requests to URVE Smart Office resource URLs immediately following an SVG file upload submission via the 'report problem' feature.
- Detection methods and tools: Web Application Firewalls (WAFs) should be configured to inspect uploaded content types and block JavaScript or harmful tags within SVG files, although this is a post-factum measure. Monitor application logs for suspicious payloads being served.
## References
- Vendor advisories: None explicitly linked, refer to CERT Polska advisory (Reported 30 October 2025).
- Relevant links - defanged:
- hxxps://cert.pl/en/author/cert-polska/
- hxxps://www.cve.org/CVERecord?id=CVE-2025-10348