Project: 
Svg Image
Date: 
2020-March-25
Security risk: 
Critical 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All
Vulnerability: 
Cross site scripting
Affected versions: 
<1.10.0
Description: 

SVG Image module allows to upload SVG files.

The module did not sufficiently protect against malicious code inside SVG files leading to a Cross Site Scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have permission to upload an SVG file.

Solution: 

Install the latest version:

Also see the Svg Image project page.

Reported By: 
Fixed By: 
Coordinated By: