CVE-2026-102290 Details

A stored cross-site scripting vulnerability has been identified in CodeCanyon Rocket LMS versions through 2.2. The issue arises in the Student Profile Image Upload component, where the application fails to properly validate or sanitize SVG files before allowing them to be uploaded. This vulnerability can be exploited remotely by authenticated users with student-level access, who can upload an SVG image containing malicious JavaScript. Once the image is uploaded, the JavaScript executes within the application's origin, leading to potential session hijacking, cookie theft, and other attacks against users who view the affected profile image.

To address this vulnerability, restrict profile image uploads to safe raster formats like PNG, JPG/JPEG, and WEBP. If SVG support is necessary, use a trusted SVG sanitizer to clean the files before acceptance. Implement server-side validation of uploaded files, checking MIME types and file signatures rather than relying solely on file extensions. Remove any `<script>` elements and JavaScript event handlers from SVG files before processing. Consider serving uploaded SVGs from a separate origin and applying a Content Security Policy to mitigate script execution risks.