Skip to content
Fencer Vulns
medium 6.1

CVE-2022-24749 json

Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius

published 2022-03-14 4 y ago modified 2026-06-17 4 mo ago also GHSA-4qrp-27r3-66fj , EUVD-2022-1312

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting (XSS) code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the IMG tag. The problem applies both to the files opened on the admin panel and shop pages. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. As a workaround, require a library that adds on-upload file sanitization and overwrite the service before writing the file to the filesystem. The GitHub Security Advisory contains more specific information about the workaround.

Patch / fix

  • packagist sylius/sylius 1.9.10, 1.10.11, 1.11.2
  • sylius sylius 1.9.10, 1.10.11, 1.11.2

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

1.11% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/Sylius/Sylius/security/advisories/GHSA-4qrp-27r3-66fj referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
packagist sylius/sylius
<1.9.10
>=1.10.0, <1.10.11
>=1.11.0, <1.11.2
1.9.10
1.10.11
1.11.2

Affected products

  • Sylius Sylius

Classification

Weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page
  • CWE-434 Unrestricted Upload of File with Dangerous Type
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.