CVE-2025-29790
Contao allows cross-site scripting through SVG uploads
Résumé
Contao allows cross-site scripting through SVG uploads
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This vulnerability is fixed in Contao 4.13.54, 5.3.30, or 5.5.6.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory contao.org
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov