CVE-2025-12544 is a vulnerability in the Publisher portal where insufficient validation of uploaded SVG files allows users with the Publisher role to inject malicious scripts. Exploitation involves uploading crafted SVG files that are stored and rendered by the application, enabling actions such as browser redirection, UI modification, or information retrieval. The impact is limited by httpOnly flags on session cookies, preventing session hijacking.