CVE-2025-70842

5.4 Moyenne

Publiée le 12/05/2026 à 17:16 · Modifiée le 17/06/2026 à 12:03 · Analyse NVD reportée · Source : cve@mitre.org

Description

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the File Management module of FluentCMS 1.2.3. The flaw allows an authenticated administrator to upload crafted SVG files containing malicious JavaScript code. Once uploaded, the script executes in the browser of any user who accesses the direct URL of the image, including unauthenticated visitors.

Traduire en français

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://github.com/fluentcms/FluentCMS/issues/2404
https://github.com/fluentcms/FluentCMS/pull/2407
https://github.com/fluentcms/FluentCMS/issues/2404

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories