AsiaInfo BSS Platform: Stored cross-site scripting via SVG upload
Summary
AsiaInfo BSS Platform 9.2 before 9.2.38 lets an authenticated user with ordinary application privileges upload an SVG file with embedded JavaScript as a menu icon. The file is served from the application's own origin. If a victim opens the stored file directly or through object or iframe, the script runs in the application origin and can steal session tokens or perform actions as the victim, including administrators. Normal menu rendering through an img element does not run the script.
Affected
- AsiaInfo BSS Platform 9.2.0 before 9.2.38
- Components aether-menu up to 2.2.4 and react-app up to 2.3.10
Fixed in
- AsiaInfo BSS Platform 9.2.38 or later (aether-menu 2.2.5, react-app 2.3.11)
Workaround
- Unknown from the vendor.
- Until patched, remove SVG from the menu icon upload or restrict uploads to raster formats.
- Serve uploaded files from a separate origin with Content-Disposition: attachment and a restrictive Content-Security-Policy.
- Review existing uploads for SVG files.
Exploitation
- No evidence of exploitation in the wild was found.
- The third-party advisory includes a proof of concept. VulDB rates exploitation as easy and remote, with user interaction required.
- Requires an authenticated account and a victim who opens the stored SVG file directly.
Our recommendation
- Confirm whether any AsiaInfo BSS Platform instance is in use, for example by a telecom operator, MVNO or integrator. Most SMEs are not affected.
- Verify the installed version and update to 9.2.38 or later.
- The research notes mention a separate critical issue fixed in 9.2.41. This is unverified, so check the vendor channel for the latest release.
- Review existing menu icon uploads for SVG files and restrict the upload allowlist.
- Check whether the administration console is reachable from the internet.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-122095 www.cve.org
- Third-party advisory (researcher repository) github.com
- VulDB entry 435973 vuldb.com
- Researcher repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:21.
Original description (NVD)
AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting (XSS) vulnerability in the menu icon upload function. An authenticated user with ordinary application privileges can upload an SVG file containing embedded JavaScript, which is served from the application origin. Normal menu rendering uses an HTML <img> element and does not execute the SVG script; exploitation requires a victim to load the uploaded SVG as a document (by directly navigating to its URL, or via <object>/<iframe>), in which case the script executes under the application origin.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.