CVE-2026-52658 — AureusERP Stored XSS (Chatter Change-Tracking)

CWE-79 · CVSS 8.7 (High) · AureusERP ≤ v1.4.0 / master

Chatter renders the change-tracking old_value / new_value fields as raw HTML ({!! !!}, no sanitization). An authenticated user editing a record stores JavaScript that fires for every viewer of the record, including admins.

.../chatter/.../messages/content-text-entry.blade.php:

{!! str($record->body)->sanitizeHtml() !!}                  // sanitized
{!! $change['old_value'] !!}   {!! $change['new_value'] !!} // NOT sanitized

PoC

Requires any authenticated account with edit rights on a record (e.g. a Project).

1. Edit the record and set a tracked field such as Name to:

2. Save — the value is written to the Chatter change-tracking log (old → new value).
3. Open the record and view its Chatter / activity panel.
4. The log renders the stored value as raw HTML and the payload executes — for anyone who views the record, including admins.