Duplicate Advisory: Contao allows admin an account to upload SVG file containing malicious JavaScript

published 2024-10-02 2 y ago modified 2026-09-10 1 mo ago also GHSA-mrw8-5368-phm3 , EUVD-2024-3089

cvss: 6.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits: 0; none known

Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6.

Patch / fix

fixed in 1

Contao Contao 4.13.54, 5.3.30, 5.5.6

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-10-02)

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

grimthereaperteam.medium.com https://grimthereaperteam.medium.com/contao-5-4-1-malicious-file-upload-xss-in-svg-30edb8820ecb referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
NVD	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

Contao Contao

Classification

Weakness

CWE-434 Unrestricted Upload of File with Dangerous Type

References

grimthereaperteam.medium.com /contao-5-4-1-malicious-file-upload-xss-in-svg-30edb8820ecb
web, exploit, third-party-advisory
contao.org /en/security-advisories/cross-site-scripting-through-svg-uploads
web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2024-45965
advisory
github.com /contao/contao
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary