~ / search / GHSA-hqxc-w9vw-3hp5

GHSA-hqxc-w9vw-3hp5

Bolt CMS Stored XSS

Source: GitHub Advisory Database (reviewed) Moderate CVE-2017-11127

Packages

EcosystemPackageAffectedFixed in
Packagist bolt/bolt <= 3.2.14 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Bolt CMS 3.2.14 allows stored XSS by uploading an SVG document with a "Content-Type: image/svg+xml" header.

References

External links from the advisory. They lead to third-party sites.