CVE-2026-72594 is a stored cross-site scripting vulnerability in lobehub's lobe-chat product up to version 2.2.13. The flaw allows a low-privileged authenticated user to upload a malicious SVG file containing embedded JavaScript as their avatar. The upload handler derives the file extension and S3 content type from the original filename rather than validating the actual file content, enabling the storage of SVG files with script elements. When other users view the attacker's profile or avatar, the embedded script executes in their browsers, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 score of 7.6 (high severity). The product is cloud-hosted, and the vendor is responsible for applying the patch and mitigating the issue.

Successful exploitation allows an attacker with low privileges to execute arbitrary JavaScript in the browsers of users who view the attacker's profile or avatar. This can lead to theft of sensitive information, session hijacking, or other client-side attacks. The vulnerability affects confidentiality and partially affects integrity but does not impact availability. The CVSS score of 7.6 reflects a high severity due to network attack vector, low attack complexity, and partial user interaction required.

A patch is available in version 2.2.14 and later. Since lobe-chat is a cloud-hosted service, the vendor manages remediation and typically applies patches server-side. Users and administrators should verify with the vendor that the service is updated to a fixed version. No additional user action is required if the vendor has applied the patch.