A flaw in FluentCMS 1.2.3’s File Management module lets an authenticated administrator upload SVG files that embed arbitrary JavaScript. When a user opens the image’s direct URL, the script runs in that user’s browser. The vulnerability is a classic stored XSS that bypasses normal media handling, allowing malicious code to be executed client‑side. The impact is limited to browsers that request the infected image, but because the image can be accessed by anyone—including visitors who have not logged in—the risk applies to all users who view the file.

FluentCMS version 1.2.3, specifically the File Management module that permits SVG uploads. The issue exists only when the system runs that exact version and an administrator is allowed to upload content.

Exploitation requires administrative credentials to upload the malicious SVG. Once the file is stored, any viewer of its URL is affected. The CVSS score of 5.4 represents moderate severity, and the lack of an EPSS value or KEV listing suggests no known public exploitation. The stored XSS nature makes the flaw a notable risk because it delivers code directly to client browsers without server‑side filtering.