CVE-2025-62418
bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)
概要
bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov