diamond_full diamond diamond_half diamond_euro search-icon menu chat-icon close-icon envelope-icon smartphone-call-icon
Blog & News

Advisory: Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education (CVE-2025-7062)

Release of SCHUTZWERK-SA-2024-007

September 9, 2026

#ADVISORIES
preview-image for SCHUTZWERK-SA-2024-007

A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.

Metadata

Details

H5P content is distributed as ZIP archives. When unpacked, an archive contains a folder structure whose files define the content of the H5P object. Images embedded in an H5P content type are stored in the content/images/ subfolder and referenced from the content/content.json file.

For this analysis, an SVG image file named circle.svg was crafted with the following content:

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<svg
   version="1.1"
   id="svg2"
   sodipodi:docname="circle.svg"
   xmlns="http://www.w3.org/2000/svg"
   xmlns:svg="http://www.w3.org/2000/svg">
  <script>alert("XSS Test");</script>
  <script>alert(document.cookie);</script>
  <circle
     style="fill:#666666;stroke:#808080;stroke-width:4.40315;stop-color:#000000"
     id="path233"
     cx="98.428535"
     cy="68.415733"
     r="54.194405" />
</svg>

Besides rendering a circle, the file contains two lines of JavaScript: the first opens a dialog showing the text “XSS Test”, and the second displays the contents of the session cookie. The file is placed in the content/images/ subfolder and referenced in content/content.json as follows:

{
  "media": {
    "type": {
      "params": {
        "decorative": false,
        "contentName": "Image",
        "expandImage": "Expand Image",
        "minimizeImage": "Minimize Image",
        "file": {
          "path": "images/circle.svg",
          "mime": "image/svg+xml",
[...]

The object’s folders and files are then repacked with the ZIP algorithm and saved locally as TrueFalse_Title_malicious.h5p. Using the upload function of the H5P framework, the attacker stores this file on the server. Running the H5P object on the server does not execute the embedded JavaScript on its own. However, opening the SVG graphic in a separate browser tab executes the contained script, and the session cookie is shown in a dialog window.

Risk

Where users can create and share H5P objects, this vulnerability can be used to hijack other users’ accounts, for example through phishing with injected fake login forms. An attacker can also track a victim’s actions within the application and perform actions on their behalf. If an administrative user is targeted, the attacker may be able to escalate privileges further, for instance by creating new administrative users or assigning additional roles to existing ones.

Solution/Mitigation

At the time of publication, no release fully prevents the upload and execution of files that contain JavaScript. Version 10.0.4 removes the SVG file extension from the default content allowlist, but it still identifies permitted files by their filename extension alone. An attacker can therefore upload a file with malicious JavaScript content under an allowed extension, such as XML, and have it executed.

Until a complete fix is available, operators should not rely on extension-based filtering alone. Uploaded files should be validated and sanitized based on their actual content rather than their filename. For SVG uploads specifically, the library’s SVGfilesanitization can be enabled, which uses DOMPurify to remove malicious script content from uploaded files.

Timeline

  • 2024-10-23 Vulnerability discovered
  • 2024-11-08 Initial contact attempt, email sent to c@lumi.education
  • 2024-11-20 Second contact attempt via a message on https://app.lumi.education/
  • 2024-11-28 Third contact attempt via a message in the Lumi Slack channel
  • 2025-02-25 First exchange between Lumi and the team of developers who use the H5P framework in their project
  • 2025-03-07 Release of h5p-nodejs-library v10.0.4 ( https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4) , which introduces an interface for file content sanitizers and an allowlist of file types permitted in H5P modules based on their filename extension. The SVG file extension is excluded.
  • 2025-09-18 Identified that the allowlist approach does not prevent the upload of files with XSS content that is executed after loading
  • 2025-09-18 Sent email to security@lumi.education with an update on the finding and received a response the same day
  • 2025-09-18 Received a response from a developer working on Lumi Education
  • 2025-09-22 Video call with a developer working on Lumi Education. Received a commitment that an updated version including a fix should be ready within a few weeks
  • 2025-09-23 Exchange with the developer on details of the fix
  • 2025-09-24 Exchange with the developer on details of the fix
  • 2025-10-20 Requested a status update on the patch from the developer. No response received.
  • 2025-11-14 Requested a status update on the patch from the developer. No response received.
  • 2025-11-20 Requested a status update on the patch from the developer. No response received.
  • 2025-11-26 Informed the business contact about the current status and recommended measures for the framework developers to implement. Publication delayed for undisclosed reasons.
  • 2026-09-09 Advisory released

Credits

The vulnerability was discovered by Florian Schmid of SCHUTZWERK GmbH.

~ Florian Schmid

Free Consultation