CVE-2025-25190: ZOO-Project Cross-Site Scripting via EchoProcess SVG Output

The EchoProcess service in ZOO-Project returns whatever input it receives, in the MIME type the caller requests. It accepts XML, JSON and SVG. When it echoes SVG back as image/svg+xml, it does not strip event handlers such as onload.

An attacker crafts a request that returns SVG with script attached and gets a victim to load it. The script runs in the victim's browser. A service built to echo input makes this a reliable vector. Commit 7a5ae1a fixes the issue.