CVE-2025-29790
Contao allows cross-site scripting through SVG uploads
概要
Contao allows cross-site scripting through SVG uploads
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This vulnerability is fixed in Contao 4.13.54, 5.3.30, or 5.5.6.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory contao.org
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov