CVE-2026-94150 Details

A stored cross-site scripting vulnerability has been identified in Omega Solution HRM OS versions through 20260717. The issue arises from the SVG file upload feature, which fails to properly validate and sanitize uploaded SVG files before they are made publicly accessible. This allows for the injection of JavaScript into the SVG, which is executed in the context of the application's origin when the file is viewed. The vulnerability can be exploited remotely, and the embedded JavaScript runs automatically, potentially leading to session compromise, unauthorized actions, phishing, credential theft, or further client-side attacks.

To address this vulnerability, uploaded SVG files should be sanitized to remove active content such as scripts and event handlers. If active content is not needed, consider disallowing SVG uploads altogether. Additionally, serve uploaded files with a restrictive Content Security Policy and consider converting SVG files into a safe raster image format before serving.