EUVD-2025-209787
GHSA-7m9c-h5vv-88gq
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the File Management module of FluentCMS 1.2.3. The flaw allows an authenticated administrator to upload crafted SVG files containing malicious JavaScript code. Once uploaded, the script executes in the browser of any user who accesses the direct URL of the image, including unauthenticated visitors.
AnalysisAI
Stored cross-site scripting (XSS) in FluentCMS 1.2.3 File Management module allows authenticated administrators to upload SVG files with embedded malicious JavaScript that executes when any user-including unauthenticated visitors-accesses the image URL directly. The vulnerability has public proof-of-concept code available via GitHub pull request, and CISA SSVC framework confirms exploitability is feasible but requires user interaction and is not automatable. CVSS 5.4 reflects the attack complexity introduced by authentication requirement and user interaction, but the cross-origin scope and ability to affect multiple users elevates real-world risk.
Technical ContextAI
The vulnerability exists in the File Management module's FileService.cs, which processes uploaded SVG files. SVG is an XML-based vector image format that supports embedded JavaScript via <script> tags and event handlers (onload, onclick, etc.). The original code failed to sanitize SVG content before persistence, allowing authenticated administrators to upload payloads that execute in-browser when served to other users. The fix involves XML parsing with DTD protection (XmlReaderSettings with DtdProcessing.Prohibit) and removal of dangerous elements (<script>, <foreignObject>) and event-handler attributes. The root cause is improper input validation and insufficient output encoding for XML-embedded scripts, classified as CWE-79 (Cross-site Scripting). CPE data indicates the vulnerability affects FluentCMS but exact version metadata is incomplete in available sources.
RemediationAI
Upgrade FluentCMS to the version containing GitHub pull request 2407 (likely 1.2.4 or later; verify with vendor release notes at https://github.com/fluentcms/FluentCMS/releases). The upstream fix sanitizes SVG files by parsing with XML security hardening (DTD processing disabled), removing dangerous elements (<script>, <foreignObject>), and stripping event-handler attributes and javascript:/vbscript:/data: scheme URLs. If immediate upgrade is not possible, implement compensating controls: disable SVG upload entirely via file extension whitelist (restrict to PNG, JPG, GIF only), or implement server-side Content Security Policy (CSP) headers with img-src 'self' and script-src that blocks inline scripts-though CSP will not prevent the XSS if images are served with unsafe CSP directives. Another control is to serve all user-uploaded content from a separate domain (subdomain or external CDN) with no access to session cookies (set Secure; SameSite=None on admin session cookies), limiting XSS scope. These workarounds reduce functionality and usability; patching is the definitive fix.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today