Description

A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar. The avatar upload handler derives the stored file extension and S3 content type from the original filename rather than inspecting file content, enabling an attacker to store an SVG containing a script element that executes in the browser of any user who views the attacker's profile or avatar.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-10T11:17:32.610Z",
  "pubdate": "2026-08-10T11:17:32.610Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists in lobe-chat through version v2.2.13, impacting the avatar upload handler.\nThe vulnerability allows low-privileged authenticated users to inject arbitrary JavaScript into the application via a crafted SVG file uploaded as a user avatar.\nThe security impact involves arbitrary script execution within the browser context of any user who views the attacker's profile or avatar, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.\nAffected systems include the lobe-hub/lobe-chat application running versions v2.2.13 and prior.\nRisk implications are moderate to high depending on the privileges of the viewing user and the sensitivity of the application environment.\nAttacker capabilities require authenticated access with low privileges to upload a profile avatar.\nExploitation requirements necessitate the attacker to upload a maliciously crafted SVG file containing executable script elements, which is subsequently rendered in the browsers of victim users.",
  "technicalDetails": "The root cause of the vulnerability stems from insecure file handling within the avatar upload handler of lobe-hub/lobe-chat.\nSpecifically, the application derives the stored file extension and S3 content type directly from the original filename provided in the upload request rather than inspecting the actual file content or magic bytes.\nThis improper validation allows an attacker to bypass intended file type restrictions by uploading an SVG file disguised with an accepted or mishandled extension, or by uploading an SVG file that the application serves with an incorrect or executable content type.\nThe vulnerable component is the avatar upload handler and storage mechanism in lobe-hub/lobe-chat through v2.2.13.\nAuthentication requirements dictate that the attacker must be an authenticated user with low privileges, and network exposure is present wherever the application is accessible over the network.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious SVG file containing embedded JavaScript within a script element or event handler. Second, the attacker uploads this crafted SVG file as their user avatar, leveraging the flawed filename-based extension and content type derivation to store the file successfully in the S3 storage backend. Third, when any other application user views the attacker's profile or avatar, the browser renders the SVG document directly.\nPayload behavior involves the execution of arbitrary JavaScript in the context of the victim's browser session.\nPost-exploitation impact includes potential session token theft, DOM manipulation, unauthorized API requests, and auxiliary attacks against other users interacting with the compromised profile."
}