{"id":"CVE-2026-122095","kind":"vulnerability","aliases":["CVE-2026-122095"],"related":[],"title":"AsiaInfo BSS Platform: stored XSS through menu icon SVG upload","description":"AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting (XSS) vulnerability in the menu icon upload function. An authenticated user with ordinary application privileges can upload an SVG file containing embedded JavaScript, which is served from the application origin. Normal menu rendering uses an HTML <img> element and does not execute the SVG script; exploitation requires a victim to load the uploaded SVG as a document (by directly navigating to its URL, or via <object>/<iframe>), in which case the script executes under the application origin.","summary":"AsiaInfo BSS Platform 9.2 before 9.2.38 lets an authenticated user upload an SVG menu icon containing JavaScript. If a victim opens that SVG file directly, the script runs under the application's origin.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asiainfo","bss-platform","other"],"not_affected_if":["no-authenticated-user-uploads","version-9.2.38-or-later"],"how_to_check":"- Check the installed BSS Platform version against `9.2.38`","fix":"- Upgrade BSS Platform to `9.2.38` or later (per the affected range in the description)","status":"open","published_at":"2026-11-11T20:17:07+00:00","first_seen_at":"2026-11-11T20:28:52+00:00","triaged_at":"2026-11-11T20:30:13+00:00","updated_at":"2026-11-11T20:30:13+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T20:30:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade BSS Platform to `9.2.38` or later (per the affected range in the description)","reach":"internet","title":"AsiaInfo BSS Platform: stored XSS through menu icon SVG upload","impact":"medium","summary":"AsiaInfo BSS Platform 9.2 before 9.2.38 lets an authenticated user upload an SVG menu icon containing JavaScript. If a victim opens that SVG file directly, the script runs under the application's origin.","audience":"businesses","category":"other","nicknames":[],"who_cares":["asiainfo","bss-platform"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Script runs under application origin, exposing session data to attacker","analyst_note":"Confirm the affected range and fixed version from the NVD entry or vendor advisory; the sources give only 'before 9.2.38'.","how_to_check":"- Check the installed BSS Platform version against `9.2.38`\n- unknown for other checks; the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-9.2.38-or-later","no-authenticated-user-uploads"],"who_is_affected":"Deployments of AsiaInfo BSS Platform 9.2 before 9.2.38 where users with ordinary application accounts can upload menu icons. Exploitation needs a victim to load the uploaded SVG as a document, not just view the menu, so the risk depends on whether users navigate to uploaded files. unknown whether other versions or configurations are affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000754,"input_tokens":4657,"output_tokens":576,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-122095':13A,16A '-2026':12A,15A '9.2':24B,57C '9.2.38':26B,59C 'applic':51B,80C,95C,139C 'asiainfo':1A,17B,21B,54C 'authent':29B,76C 'bss':2A,19B,22B,55C 'bss-platform':18B 'case':133C 'contain':36B,87C 'cross':64C 'cross-sit':63C 'cve':11A,14A 'direct':45B,124C 'document':122C 'element':103C 'embed':88C 'execut':107C,136C 'exploit':111C 'file':44B,86C 'function':74C 'html':102C 'icon':8A,35B,72C 'javascript':37B,89C 'let':27B 'load':116C 'menu':7A,34B,71C,98C 'navig':125C 'normal':97C 'open':41B 'ordinari':79C 'origin':53B,96C,140C 'platform':3A,20B,23B,56C 'privileg':81C 'render':99C 'requir':112C 'run':48B 'script':47B,66C,110C,135C 'serv':92C 'site':65C 'store':4A,62C 'svg':9A,33B,43B,85C,109C,119C 'upload':10A,31B,73C,83C,118C 'url':128C 'use':100C 'user':30B,77C 'via':130C 'victim':40B,114C 'vulner':68C 'xss':5A,67C","nicknames":[],"mitigations":[],"who_affected":"Deployments of AsiaInfo BSS Platform 9.2 before 9.2.38 where users with ordinary application accounts can upload menu icons. Exploitation needs a victim to load the uploaded SVG as a document, not just view the menu, so the risk depends on whether users navigate to uploaded files. unknown whether other versions or configurations are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["asiainfo","bssplatform","high","other"],"campaign_type":null,"search_a":"'-122095':13A,16A '-2026':12A,15A 'asiainfo':1A 'bss':2A 'cve':11A,14A 'icon':8A 'menu':7A 'platform':3A 'store':4A 'svg':9A 'upload':10A 'xss':5A","search_b":"'9.2':24B '9.2.38':26B 'applic':51B 'asiainfo':17B,21B 'authent':29B 'bss':19B,22B 'bss-platform':18B 'contain':36B 'direct':45B 'file':44B 'icon':35B 'javascript':37B 'let':27B 'menu':34B 'open':41B 'origin':53B 'platform':20B,23B 'run':48B 'script':47B 'svg':33B,43B 'upload':31B 'user':30B 'victim':40B","search_c":"'9.2':57C '9.2.38':59C 'applic':80C,95C,139C 'asiainfo':54C 'authent':76C 'bss':55C 'case':133C 'contain':87C 'cross':64C 'cross-sit':63C 'direct':124C 'document':122C 'element':103C 'embed':88C 'execut':107C,136C 'exploit':111C 'file':86C 'function':74C 'html':102C 'icon':72C 'javascript':89C 'load':116C 'menu':71C,98C 'navig':125C 'normal':97C 'ordinari':79C 'origin':96C,140C 'platform':56C 'privileg':81C 'render':99C 'requir':112C 'script':66C,110C,135C 'serv':92C 'site':65C 'store':62C 'svg':85C,109C,119C 'upload':73C,83C,118C 'url':128C 'use':100C 'user':77C 'via':130C 'victim':114C 'vulner':68C 'xss':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T20:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122095","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122095","severity":null,"published_at":"2026-11-11T20:17:07+00:00","modified_at":"2026-11-11T20:17:07+00:00","first_seen_at":"2026-11-11T20:28:52+00:00","fetched_at":"2026-11-11T20:28:52+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}