CVE-2025-55135: Agora Foundation Agora

Medium severity, CVSS 6.4. EPSS: 0.3% chance of exploitation in the next 30 days.

In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/routes/userRoutes.js; this includes SVG.

Affected products

• Agora Foundation Agora

Published 2025-08-07. Last modified 2026-06-17.