CVE-2021-32245

In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS

published June 16, 2021

CVSS
—
EPSS
1%
Percentile
44.7
In the wild
Unconfirmed
What it is

In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/exp.svg" that will point to http://localhost/pagekit/storage/exp.svg. When a user comes along to click that link, it will trigger a XSS attack.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00541 · 44.7th percentile
Published
2021-06-16T20:37Z
EPSS history
Timeline
  • 16 JUN 20:37Z
    In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS
    cvelistv5