CVE-2025-10348: Eveo Urve Smart Office

Medium severity, CVSS 5.1. EPSS: 0.4% chance of exploitation in the next 30 days.

URVE Smart Office is vulnerable to Stored XSS in report problem functionality. An attacker with a low-privileged account can upload an SVG file containing a malicious payload, which will be executed when a victim visits the URL of the uploaded resource. The resource is available to anyone without any form of authentication. This issue was fixed in version 1.1.24.

Affected products

• Eveo Urve Smart Office: before 1.1.24 (fixed in 1.1.24)

Published 2025-10-30. Last modified 2026-10-08.