Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.4
CVE-2025-55135: Agora Foundation Agora User Profile Picture Upload Vulnerability
CVE-2025-55135 · published 1 year ago
Summary
An attacker can exploit a vulnerability in the Agora Foundation Agora user profile picture upload process, potentially allowing them to inject malicious code into the system. This could happen if an administrator or user uploads a profile picture in an allowed but potentially insecure format, such as SVG. To mitigate this, Agora Foundation should restrict allowed file formats for profile pictures to ensure only safe formats like PNG, JPEG, and WEBP can be uploaded.
Original advisory text
In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/rou...
In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/routes/userRoutes.js; this includes SVG.
References
- https://github.com/agorafoundation/agora/blob/90f7f9c217cf1d5dc9d27f5695cd65b61a... URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55135... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-55135 Vendor Advisory
- https://github.com/agorafoundation/agora/commit/690ce56f254af01375b6033e53a80f14... Patch
- https://github.com/agorafoundation/agora/pull/556 Patch
- https://github.com/Msfv3n0m/vulnerability-research/tree/main/CVE-2025-55135 URL
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-434Unrestricted File Upload
Timeline
Published7 Aug 2025
Updated3 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta