CVE-2025-50738

It is quite simple, a stored XSS via SVG is a very common way of finding Cross-Site Scripting in the wild, so it was one of the first things I did.

I deployed the usememos via Pikapods, where I then navigated to the front-page and created an account. With the account, I created a ’thought':

Which I then created an SVG file, containing the following payload:

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)">
   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
</svg>

This payload executes JavaScript, resulting in printing the ‘document.domain’ (so it just shows ‘*.pikapod.net’). I selected the file, in this case it was called xss6.svg and I could then ‘copy image address’:

As you notice, the XSS does not execute inside the main page, sadly. I tried some maneuvers to get it to work, but without success. So entering the copied URL, results in a XSS pop-up – revealing the URL:

For more on this vulnerability, see my blogpost at: https://tiem.io/cves/cve-2025-50738-stored-xss-via-svg/