GCVE-1988-2026-0440

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SCHUTZWERK-SA-2024-007",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "David Brown via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n\n\nMetadata\n========\n\n- - Affected product: h5p-nodejs-library\n\n  the time of publication)\n- - Vendor: Lumi Education UG\n- - Problem type(s):\n\n    - CWE-20 Improper Input Validation\n- - CVE ID: CVE-2025-7062\n- - CVE URL: https://www.cve.org/CVERecord?id=CVE-2025-7062\n- - CVSS 4.0 score: 5.2\n- - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/\n\nDetails\n=======\n\n\ncontent/content.json file.\n\n\ncontent:\n\n<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?>\n<svg\n   version=\"1.1\"\n   id=\"svg2\"\n   sodipodi:docname=\"circle.svg\"\n   xmlns=\"http://www.w3.org/2000/svg\";\n   xmlns:svg=\"http://www.w3.org/2000/svg\";>\n  <script>alert(\"XSS Test\");</script>\n  <script>alert(document.cookie);</script>\n  <circle\n\n     id=\"path233\"\n     cx=\"98.428535\"\n     cy=\"68.415733\"\n     r=\"54.194405\" />\n</svg>\n\n\n\ncontent/content.json as follows:\n\n{\n  \"media\": {\n    \"type\": {\n      \"params\": {\n        \"decorative\": false,\n        \"contentName\": \"Image\",\n        \"expandImage\": \"Expand Image\",\n        \"minimizeImage\": \"Minimize Image\",\n        \"file\": {\n          \"path\": \"images/circle.svg\",\n          \"mime\": \"image/svg+xml\",\n[...]\n\n\n\nwindow.\n\nRisk\n====\n\n\nadditional roles to existing ones.\n\nSolution/Mitigation\n===================\n\n\nallowed extension, such as XML, and have it executed.\n\n\nfrom uploaded files.\n\nTimeline\n========\n\n- - 2024-10-23 Vulnerability discovered\n- - 2024-11-08 Initial contact attempt, email sent to c@lumi.education\n\n- - 2024-11-28 Third contact attempt via a message in the Lumi Slack channel\n\n  framework in their project\n- - 2025-03-07 Release of h5p-nodejs-library v10.0.4\n\n  excluded.\n\n  with XSS content that is executed after loading\n\n  received a response the same day\n\n- - 2025-09-23 Exchange with the developer on details of the fix\n- - 2025-09-24 Exchange with the developer on details of the fix\n\n  received.\n\n  received.\n\n  received.\n\n  reasons.\n- - 2026-09-09 Advisory released\n\nCredits\n=======\n\nThe vulnerability was discovered by Florian Schmid of SCHUTZWERK GmbH.\n\nFootnotes\n=========\n\n\n-----BEGIN PGP SIGNATURE-----\n\niQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmqg+lcaHGFkdmlzb3Jp\nZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrtd7hAAt/fhW+fVFc5JlaevO/pu\nOlVkBwTQjZcX3qxZRgAVbV0HuwLPh/YTgiCLjidVfAIzVJbQSU0eDKrt3G4t82Te\nrhXkY0ctzwOGya3nIwEI/I/QpKH/W75NDRL2ewI7iiJB8guQWBZzb7cFSAOoeNMi\nnUkdo35BwqNr+TccXjNVwnlsXHTdW1RbzIwE9yUHujjT7vkUNcoDftPoguBjRsG1\nOSlcjqDvMPNkApQiXWniwz0wY/6WYQgt96RB96Wl0uJLMazLgtgVgso7rcZW3Sjd\npi1yHYD3f+/ch9iPQBFq0SIcnH+kJC2oNXypM0VDjtCdNt+KveiBnbJsl9zSTdHj\nylllLxE58bkVuONcInxHeo6MSRBGLAJ0Hiq1uHFeQuya6L53Lr5Nb65IVQJe3f2T\nx56Gwhs+xhGr/hd0k/CmaRXxApFm8HPLr1M3uCPrJXzT6THBZxcuWcJr9WXUj1ZT\nWNBHlf06aK8SWHtVDugeTJK38N/Esetc9Z8XY1PdiVp4ab0qJMi9w4YWtJgeeL2d\nTbIObBSI0i9OR1GdrXvVKB6F/PvpuTHupCMR+2yI/mMEzb2KgDQiZpEqh1qOy01u\nB+7bH2qwlnZrz6SL0vfZCwZ/KJbKf+/hSq+3V4XcK415cQsUZbT07y5qxUZIK/wE\nnpRisQyYZ+Z+QaMWsSxMf7c=\n=pVF/\n-----END PGP SIGNATURE-----\n\n\n--\nSCHUTZWERK GmbH, Pfarrer-Weiß-Weg 12, 89077 Ulm, Germany\nZertifiziert / Certified ISO 27001, 9001 and TISAX\n\nPhone +49 731 977 191 0\n\nadvisories () schutzwerk com / www.schutzwerk.com\n\nGeschäftsführer / Managing Directors:\nJakob Pietzka, Michael Schäfer\n\nAmtsgericht Ulm /  HRB 727391\nDatenschutz / Data Protection www.schutzwerk.com/datenschutz\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:34Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/41"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/41"
        },
        {
          "url": "http://www.w3.org/2000/svg\""
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-7062"
        },
        {
          "url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/41"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SCHUTZWERK-SA-2024-007: Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-7062",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0440",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/41",
            "automated": true,
            "contentSha256": "3ecef1f5be0f8be57ccf72de8b9866918875c1fbaf3731e33c88fa3d82889af8",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/41",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-09T06:21:46Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:34Z",
    "dateUpdated": "2026-10-02T04:57:34Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0440"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}