Security Advisory

CVE-2024-6581

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2024-10-29 12:49:01

Last updated 2024-10-29 13:24:02

Assigner @huntr_ai

State PUBLISHED

Description

A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filtering in the sanitize_svg function, this can lead to cross-site scripting (XSS) vulnerabilities, which in turn pose a risk of remote code execution. The sanitize_svg function only removes script elements and on* event attributes, but does not account for other potential vectors for XSS within SVG files. This vulnerability can be exploited when authorized users access a malicious URL containing the crafted SVG file.

← Browse all CVEs View on cve.org ↗