~ / search / GHSA-mrw8-5368-phm3

GHSA-mrw8-5368-phm3

Withdrawn on 2025-04-22. GitHub withdrew this advisory; it no longer applies.

Duplicate Advisory: Contao allows admin an account to upload SVG file containing malicious JavaScript

Source: GitHub Advisory Database (reviewed) Low CVE-2024-45965

Packages

EcosystemPackageAffectedFixed in
Packagist contao/contao <= 5.4.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vqqr-fgmh-f626. This link is maintained to preserve external references. ## Original Description Contao 5.4.1 allows an authenticated admin account to upload a SVG file containing malicious javascript code into the target system. If the file is accessed through the website, it could lead to a Cross-Site Scripting (XSS) attack or execute arbitrary code via a crafted javascript to the target.

References

External links from the advisory. They lead to third-party sites.