CVE-2026-54380

Name of the Vulnerable Software and Affected Versions VitaFit cloud API versions prior to 2026-10-30

Description An authenticated attacker can upload an SVG image containing malicious JavaScript to the shared storage bucket. The issue occurs because the application fails to restrict scripts or force downloads for image/svg+xml content, which allows the JavaScript to execute when a victim opens the file through direct browser navigation. This is a stored cross-site scripting (XSS) issue, where a malicious script is permanently stored on the target server.

Recommendations Update VitaFit cloud API to a version released on or after 2026-10-30.