CVE-2025-55742: UnoPim Stored Cross-site Scripting Vulnerability in User Creation Functionality
Summary
CVE-2025-55742: UnoPim has Stored Cross-site Scripting vulnerability in user creation functionality. Affects unopim/unopim versions < 0.2.1. Fixed in 0.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
UnoPim is an open-source e-commerce platform that provides a range of functionalities for managing online stores, including product management, user management, and order processing. The platform is built on PHP and utilizes the Packagist ecosystem for package management. This vulnerability specifically affects the user creation functionality, allowing attackers to exploit the system through improper file sanitization.
Vulnerability Detail
The vulnerability arises from a stored cross-site scripting (XSS) flaw in the user creation endpoint of UnoPim. Attackers can upload malicious SVG files disguised as GIF files by manipulating the MIME type. This allows them to execute arbitrary JavaScript in the context of another user's session, potentially leading to unauthorized actions on behalf of the victim. The vulnerability is rooted in the inadequate validation of file types and the failure to properly sanitize uploaded content.
How To Fix
Minimum fixed version
0.2.1
This is the first release that contains the fix.
composer require unopim/unopim:0.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict file uploads to specific allowed extensions and MIME types. For example, you can modify the file upload handling code to check for allowed extensions like '.jpg', '.png', and '.gif' and reject any files that do not meet these criteria.
Conclusion
The CVE-2025-55742 vulnerability in UnoPim poses a significant risk due to its potential for stored cross-site scripting attacks. It is crucial for users to update to the patched version and implement additional security measures to safeguard against such vulnerabilities.
See every vulnerability recorded for unopim/unopim →
FAQ
The vulnerability is a stored cross-site scripting (XSS) flaw that allows attackers to execute malicious scripts in the context of another user's session.
If you are using UnoPim version 0.2.0 or earlier, your application is vulnerable. You can check your application's composer.lock file or use Vulert to monitor for vulnerabilities.
An attacker could perform actions on behalf of another user, such as creating products or accessing sensitive information, leading to unauthorized access and data manipulation.
Yes, the vulnerability has been patched in version 0.2.1 of the UnoPim package. It is recommended to update to this version.
Vulert monitors open-source vulnerabilities in your software using the composer.lock file, providing real-time alerts for any detected issues, including this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for unopim/unopim.
