nocobase-advisory.txt

NocoBase Stored Content Upload Vulnerability

Vulnerability: Stored Cross-Site Scripting (XSS) / Arbitrary Active Content Upload in NocoBase
Affected Versions: Versions prior to 2.0.52, 2.1.0-alpha.35, and 2.1.0-beta.32
Fixed Versions: 2.0.52, 2.1.0-alpha.35, and 2.1.0-beta.32
Reported Date: 2026-04-18
Researcher: x0root (@x0root)

Technical Details

Type: Stored Cross-Site Scripting (XSS)
Attack Vector: Remote
Impact: Information Disclosure, Phishing, Execution of attacker-controlled JavaScript under trusted domain

Description

A stored cross-site scripting vulnerability exists in NocoBase versions prior to 2.0.52, 2.1.0-alpha.35, and 2.1.0-beta.32 when using local/public storage configurations.

Authenticated attackers can upload active content files such as .html, .xhtml, and .svg containing malicious JavaScript payloads. These files can then be accessed directly through the application's interface under the trusted NocoBase domain.

When a victim opens the uploaded file, attacker-controlled JavaScript executes within the browser context of the NocoBase domain. This can be used for phishing, trusted-domain script execution, and potential disclosure of browser-accessible data.

Affected Component

- File Manager
- Local/Public Storage Handler
- File Preview Functionality
- Lead Insights file upload component

Proof of Concept

1. Go to the dashboard
2. Go to the Leads page
3. Click Add New
4. Name it anything random
5. Click Submit
6. Search for the newly created lead on the Leads page
7. Open it
8. Under Lead Insights, locate the card with the textarea and upload button
9. Upload a malicious SVG file containing JavaScript
10. Click Submit
11. Click the SVG preview
12. Right-click it and open it in a new tab
13. The JavaScript executes

HTML variant:

1. Upload a malicious HTML file instead of SVG
2. Click Submit
3. The application generates a link for the uploaded file
4. Click the link
5. The HTML executes directly in the browser

Example Payload

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
  <script type="text/javascript">
    alert(document.domain);
    alert(document.cookie);
  </script>
</svg>

Mitigation

Upgrade to:
- 2.0.52 or later
- 2.1.0-alpha.35 or later
- 2.1.0-beta.32 or later

References

- Fix PR: https://github.com/nocobase/nocobase/pull/9437
- Public acknowledgment: https://github.com/nocobase/nocobase/pull/9437#issuecomment-4468774127
- Security documentation: https://docs.nocobase.com/security/guide#file-storage