KUNO CMS CVE-2025-61768

Requires an authenticated administrator session on the KUNO CMS admin panel (PR:H) and the ability to upload files through the Media module; the attacker must craft an SVG containing an external image/resource reference that the server dereferences. Exploitation is limited by the need for full administrative privileges, so it is primarily relevant where admin accounts may be shared, weakly protected, or compromised. Note that the vendor fix (commit 804b2909) removes the condition entirely by disallowing SVG (and WebP) uploads, so patched 1.3.15+ default configurations are not exploitable via this path.

This is a genuinely low-to-moderate priority issue, and the signals are consistent rather than conflicting. The CVSS 4.0 base score of 5.1 (medium) is driven down by PR:H - exploitation requires an already-authenticated administrator (per the description and the PR:H metric), which is the single biggest limiting factor. EPSS is low at 0.34% (25th percentile), aligning with the absence of a KEV listing and the lack of any identified public exploit code; there is no evidence of active or opportunistic exploitation. The impact is bounded: AV:N/AC:L make the request itself easy to issue, but the realized harm (VC:L / low confidentiality, SC:L subsequent-system confidentiality from reaching internal hosts) is limited to information disclosure and internal network probing rather than code execution or data destruction. No SSVC decision data was supplied in the input. Net: a legitimate defense-in-depth fix, but because it is gated behind full admin privileges on a niche product, it is not an urgent, widely-targeted threat - treat as routine patching rather than emergency remediation.

An attacker who has already obtained administrator credentials for a KUNO CMS instance logs into the admin panel and uploads a crafted SVG file in the Media module containing an external image/resource reference. When the server processes the SVG it initiates an outbound request to the attacker-controlled or internal URL, letting the attacker probe internal services or exfiltrate response data. No public exploit code was identified in the provided intelligence.