CVE-2026-2939 Details

A stored cross-site scripting vulnerability has been identified in the Itsourcecode Student Management System version 1.0. The issue arises in the Add Student module, specifically within the profile picture upload feature. The application permits users with administrative rights to upload SVG files without adequate validation or sanitization. Since SVG files can contain embedded JavaScript, a malicious payload uploaded as a profile image is stored on the server and executed when the image is viewed through the Manage Student module or opened in a new browser tab.

It is recommended to disallow SVG uploads entirely if not necessary, or to sanitize SVG files using a trusted library to remove scripts and event handlers. Additionally, enforce strict Content-Type validation, store uploaded files outside the web root, and implement a strong Content Security Policy.