GHSA-6xmx-85x3-4cv2Low

Stored XSS via SVG File Upload

Published
December 13, 2023
Last Modified
December 13, 2023

🔗 CVE IDs covered (1)

CVE-2023-49279 →

📋 Description

Impact

A user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed.

Workaround

Implement the server side file validation https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation

or

Serve all media from an different host (e.g cdn) that where umbraco is hosted

🎯 Affected products5

  • nuget/Umbraco.CMS:>= 7.0.0, < 7.15.11
  • nuget/Umbraco.CMS:>= 8.0.0, < 8.18.9
  • nuget/Umbraco.CMS:>= 9.0.0, < 10.7.0
  • nuget/Umbraco.CMS:>= 11.0.0, < 11.5.0
  • nuget/Umbraco.CMS:>= 12.0.0, < 12.2.0

🔗 References (4)