---
id: "CVE-2026-54380"
kind: "vulnerability"
aliases: ["CVE-2026-54380"]
title: "VitaFit cloud API: stored XSS via uploaded SVG images"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["cloud-api", "stored-xss", "vendor", "vitafit"]
not_affected_if: ["no-vitafit-use"]
published_at: "2026-11-04T22:18:06+00:00"
first_seen_at: "2026-11-04T23:08:49+00:00"
updated_at: "2026-11-04T23:10:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54380", "first_seen_at": "2026-11-04T23:08:49+00:00"}]
exploit_sources: []
---

# VitaFit cloud API: stored XSS via uploaded SVG images

The VitaFit cloud API before 2026-10-30 lets an authenticated user upload an SVG image containing JavaScript to the shared storage bucket. When a victim opens the file directly in a browser, the script runs, because the service does not block scripts or force downloads for image/svg+xml content.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-04T23:08:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54380

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vitafit-cloud-api-stored-xss-via-svg-file-upload

## From the sources

VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket. Attackers can exploit the application's failure to restrict scripts or force downloads for image/svg+xml content, causing the JavaScript to execute when a victim opens the file via direct browser navigation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_