Sveltycms
Monthly
Server-side request forgery in SveltyCMS 0.0.6 lets an authenticated, low-privileged user (CVSS PR:L, confirmed in both the supplied CVSS 4.0 vector and the independent assessment) force the server to make outbound requests by supplying a crafted remote media/importer URL to the File Upload Endpoint at /mediagallery/upload-media. Exploitation requires valid credentials on a reachable instance that exercises remote media fetching, and the resulting impact is limited (low confidentiality, integrity, and availability, no scope change, no user interaction) - this is a real-but-modest issue rather than a top-priority one. No public exploit code was identified at time of analysis, the flaw is not confirmed actively exploited (CISA KEV), and the vendor has published an upstream fix commit (05b4f9efeb79e9d72a693232334d7529687f896f) that replaces raw outbound fetches with validated egress helpers.
Stored cross-site scripting in SveltyCMS 0.0.6 allows an authenticated user who can upload media to plant a malicious SVG that executes in the browser of anyone who later views it. The flaw sits in src/utils/media/media-service.server.ts, where the large-file/streaming upload path bypassed the sanitizeSvg / bufferAndSanitizeSvg routine and the MAX_SVG_BYTES size cap, so unsanitized SVG markup reaches storage and is served back to victims; the supplied vector (AV:N/PR:L/UI:P) confirms exploitation requires a media-upload-capable account and victim interaction, and no public exploit code or confirmed active exploitation was identified at time of analysis. Scored 5.1 in CVSS 4.0 terms, this is a moderate-severity stored XSS confined to SveltyCMS 0.0.6 prior to the referenced fix commit.
Improper access control in SveltyCMS 0.0.6 allows an authenticated low-privilege user to submit privileged attributes such as role, isAdmin, roleIds, or permissions through the User Attribute Update Endpoint at src/routes/api/[...path]/+server.ts and thereby alter account privileges. The flaw is remotely reachable with no user interaction and, per the independent assessment, has high confidentiality, integrity, and availability impact, though exploitation requires valid low-privilege credentials and the product is a pre-release CMS with essentially no production deployment. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE; an upstream fix is available as commit 05b4f9efeb79e9d72a693232334d7529687f896f, but a tagged release containing it is not independently confirmed.
Server-side request forgery in SveltyCMS 0.0.6 lets an authenticated, low-privileged user (CVSS PR:L, confirmed in both the supplied CVSS 4.0 vector and the independent assessment) force the server to make outbound requests by supplying a crafted remote media/importer URL to the File Upload Endpoint at /mediagallery/upload-media. Exploitation requires valid credentials on a reachable instance that exercises remote media fetching, and the resulting impact is limited (low confidentiality, integrity, and availability, no scope change, no user interaction) - this is a real-but-modest issue rather than a top-priority one. No public exploit code was identified at time of analysis, the flaw is not confirmed actively exploited (CISA KEV), and the vendor has published an upstream fix commit (05b4f9efeb79e9d72a693232334d7529687f896f) that replaces raw outbound fetches with validated egress helpers.
Stored cross-site scripting in SveltyCMS 0.0.6 allows an authenticated user who can upload media to plant a malicious SVG that executes in the browser of anyone who later views it. The flaw sits in src/utils/media/media-service.server.ts, where the large-file/streaming upload path bypassed the sanitizeSvg / bufferAndSanitizeSvg routine and the MAX_SVG_BYTES size cap, so unsanitized SVG markup reaches storage and is served back to victims; the supplied vector (AV:N/PR:L/UI:P) confirms exploitation requires a media-upload-capable account and victim interaction, and no public exploit code or confirmed active exploitation was identified at time of analysis. Scored 5.1 in CVSS 4.0 terms, this is a moderate-severity stored XSS confined to SveltyCMS 0.0.6 prior to the referenced fix commit.
Improper access control in SveltyCMS 0.0.6 allows an authenticated low-privilege user to submit privileged attributes such as role, isAdmin, roleIds, or permissions through the User Attribute Update Endpoint at src/routes/api/[...path]/+server.ts and thereby alter account privileges. The flaw is remotely reachable with no user interaction and, per the independent assessment, has high confidentiality, integrity, and availability impact, though exploitation requires valid low-privilege credentials and the product is a pre-release CMS with essentially no production deployment. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE; an upstream fix is available as commit 05b4f9efeb79e9d72a693232334d7529687f896f, but a tagged release containing it is not independently confirmed.