CVE-2021-47958CWE-918

CouchCMS 2.2.1 Server-Side Request Forgery via SVG upload

Medium · published May 15, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
14.0
In the wild
Unconfirmed
What it is

CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SVG files. Attackers can upload SVG files containing external entity references through the browse.php endpoint to access internal services and resources.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
EPSS
0.00238 · 14.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-05-15T18:36Z
EPSS history
Timeline
  • 15 MAY 18:36Z
    CouchCMS 2.2.1 Server-Side Request Forgery via SVG upload
    cvelistv5