Description (CNA)
Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This vulnerability is fixed in Contao 4.13.54, 5.3.30, or 5.5.6.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| contao / contao | affected >= 4.0.0, < 4.13.54; affected >= 5.0.0, < 5.3.30; affected >= 5.4.0, < 5.5.6 |
CWE
CWE-79
References
- https://github.com/contao/contao/security/advisories/GHSA-vqqr-fgmh-f626
- https://contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads
ADP enrichment
No English description supplied.
No references supplied.