Description

A stored cross-site scripting (XSS) vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check. The pkg/rclonefs/base.go PutMultipart function validates the Content-Type header supplied by the client rather than inspecting the actual file content, enabling an attacker to rename a file to .jpg while specifying image/svg+xml to bypass the filter and store a script-bearing SVG in the web root.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-10T11:17:31.270Z",
  "pubdate": "2026-08-10T11:17:31.270Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists in fastschema through v0.15.1, allowing a low-privileged authenticated user to execute arbitrary JavaScript within the context of the application. The vulnerability arises due to insufficient file validation mechanisms during the upload process, enabling an attacker to bypass MIME type allow-list checks and store a malicious SVG file directly in the web root. Successful exploitation allows attackers to persist malicious scripts that execute in the browsers of other users interacting with the application, potentially leading to session hijacking, defacement, or unauthorized actions performed on behalf of the victim. The attack requires low-privileged authentication and the ability to perform multipart file uploads. The risk implication is significant as it compromises the integrity and confidentiality of the web application environment by leveraging trusted file upload functionalities for arbitrary script injection.",
  "technicalDetails": "The vulnerability resides in the file upload and handling logic of fastschema through v0.15.1, specifically within the PutMultipart function located at pkg/rclonefs/base.go. The root cause of the security flaw is improper input validation and reliance on client-supplied metadata rather than secure file inspection techniques. Specifically, the function validates the Content-Type header supplied by the client during the multipart upload instead of inspecting the actual magic bytes or internal content structure of the uploaded file. To exploit this vulnerability, a low-privileged authenticated attacker can craft a malicious Scalable Vector Graphics (SVG) file containing embedded JavaScript payloads. The attacker then uploads this file by renaming the file extension to .jpg while explicitly supplying an image/svg+xml Content-Type header in the HTTP request. Because the server trusts the client-provided header and bypasses strict deep-content inspection, the validation check is successfully circumvented. The server then writes the script-bearing SVG file into the web root directory. When another user or an administrator navigates to the stored file or when it is rendered by the application, the embedded JavaScript executes within the victim's browser context. The attack flow involves authentication as a low-privileged user, crafting the polyglot file, transmitting the manipulated multipart upload request to bypass the pkg/rclonefs/base.go validation logic, and successful persistence in the web root. The impact includes persistent cross-site scripting (XSS), session compromise, and unauthorized interaction with the underlying fastschema application."
}