CVE-2018-25157

Vulnerability

Phraseanet 4.0.3 contains a stored cross-site scripting (XSS) vulnerability in its document upload feature. The root cause is insufficient sanitization of file names; an authenticated user can upload a file with a name containing a double-quote followed by an SVG onload event handler, such as "><svg onload=alert(1)>.jpg [4].

Exploitation

An attacker must be an authenticated user (or potentially a guest, depending on configuration) and upload a file with a maliciously crafted name. The SVG script executes when the file is viewed in a browser, triggering the payload on any subsequent page load for any user visiting the uploaded content [4]. The exploit does not require special network position other than access to the upload interface. Note that browsers with built-in XSS filters (e.g., Chrome) may mitigate the attack, but other browsers remain affected [4].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session. Common payloads include cookie theft (via alert(document.cookie)) or user redirection (via window.history.back()), potentially leading to account takeover or phishing [4].

Mitigation

The vulnerability has been fixed in Phraseanet version 4.0.7 [4]. Users running 4.0.3 or any earlier version should upgrade immediately. The project has since evolved into Phrasea, a rewritten solution, which should not be affected by this legacy flaw [1][3].