search

FluentCMS Stored XSS via SVG Upload in File Management (CVE-2025-15549)

Author: Beatriz Fresno Naumova (beafn28), Jarosław Wawiórko

Date: 29/01/2026

Vendor: FluentCMS

Product: FluentCMS

Versions affected: ≤ 0.0.5

Component: File Management module (SVG upload handling)

CWE: CWE-79 – Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting)

Attack type: Remote (authenticated)

Impact: Stored Cross-Site Scripting (XSS)

hashtag
Description

FluentCMS versions up to and including 0.0.5 are affected by a stored Cross-Site Scripting (XSS) vulnerability in the File Management module.

The application allows authenticated administrators to upload SVG files without proper sanitization. Since SVG files can contain embedded JavaScript, a malicious administrator can upload a crafted SVG file containing arbitrary JavaScript code.

Because uploaded files are stored in a publicly accessible directory and served without restrictive security headers, the malicious JavaScript is executed in the browser of any user who accesses the uploaded file URL, including unauthenticated visitors.

hashtag
Impact

hashtag
Primary impact

Execution of arbitrary JavaScript in the browser context of users accessing the malicious SVG file.

hashtag
Consequences

  • Execution of attacker-controlled JavaScript

  • User interface manipulation

  • Redirection to malicious external websites

  • Potential session compromise depending on browser context

hashtag
CVSS Details

hashtag
CVSS v4.0 Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Base Score: 4.8 (Medium)

hashtag
Solution

At the time of disclosure, no official fix was available.

hashtag
Recommendation

  • Disallow SVG uploads or strictly sanitize SVG content before storage.

  • Remove or neutralize embedded JavaScript within uploaded files.

  • Serve uploaded files with restrictive security headers (e.g., Content-Security-Policy).

  • Restrict public access to uploaded files when possible.

hashtag
Mitigation

  • Validate file types beyond extension checks.

  • Sanitize SVG files using a secure SVG sanitizer.

  • Serve user-uploaded files from a separate domain.

  • Perform regular security reviews of file upload functionality.

hashtag
Discoverer

  • Jarosław Wawiórko

  • Beatriz Fresno Naumova (beafn28)

hashtag
References

Previousbirkir prime GraphQL GET-Based CSRF (CVE-2025-15550)

Last updated