Aureus ERP through version 1.6.0 allows authenticated users to upload SVG files that are stored publicly and served from the same origin as the application. These SVG files can contain embedded JavaScript, which executes in the context of the application when the file URL is opened. This improper neutralization of input during web page generation results in a cross-site scripting vulnerability (CVE-2026-97062). The vulnerability enables attackers to steal session cookies and CSRF tokens, potentially compromising user sessions.

Exploitation of this vulnerability allows an attacker with authenticated access to upload malicious SVG files containing JavaScript. When these files are accessed, the embedded scripts execute in the application's origin context, enabling theft of session cookies and CSRF tokens. This can lead to session hijacking and unauthorized actions performed on behalf of the victim user.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the ability to upload SVG files or sanitize SVG content to remove scripts. Limit access to the upload functionality to trusted users only and consider serving uploaded files from a separate domain or sandboxed environment to prevent script execution in the application origin.