Description
A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG Media Upload. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The patch is named 05b4f9efeb79e9d72a693232334d7529687f896f. Applying a patch is the recommended action to fix this issue.
Published: 2026-09-18
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑site scripting via SVG media upload
Action: Patch
AI Analysis

Impact

A flaw in the media-service.server.ts file of SveltyCMS allows an attacker to execute arbitrary JavaScript in the victim’s browser by uploading a crafted SVG file. The vulnerability is a classic reflected or stored XSS (CWE‑79) and is also associated with code injection weaknesses in the SVG handling logic (CWE‑94).

Affected Systems

SveltyCMS version 0.0.6 is affected; the issue resides in the SVG media upload component located at src/utils/media/media-service.server.ts.

Risk and Exploitability

The CVSS score of 5.1 classifies the problem as moderate severity, while the EPSS score of less than 1 % indicates a very low, but non‑zero, likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack can be triggered remotely by submitting a malicious SVG file to the media upload endpoint, leveraging the lack of proper sanitisation and encoding of SVG input.

Generated by OpenCVE AI on September 19, 2026 at 19:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official patch commit 05b4f9efeb79e9d72a693232334d7529687f896f to SveltyCMS 0.0.6
  • Disable or restrict SVG media uploads until the patch can be applied
  • Sanitise or validate all user‑supplied SVG content before processing to mitigate XSS

Generated by OpenCVE AI on September 19, 2026 at 19:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 18 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG Media Upload. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The patch is named 05b4f9efeb79e9d72a693232334d7529687f896f. Applying a patch is the recommended action to fix this issue.
Title SveltyCMS SVG Media Upload media-service.server.ts cross site scripting
First Time appeared Sveltycms
Sveltycms sveltycms
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:sveltycms:sveltycms:*:*:*:*:*:*:*:*
Vendors & Products Sveltycms
Sveltycms sveltycms
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Sveltycms Sveltycms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-18T15:43:38.878Z

Reserved: 2026-09-18T08:26:48.749Z

Link: CVE-2026-93505

cve-icon Vulnrichment

Updated: 2026-09-18T15:43:25.297Z

cve-icon NVD

Status : Deferred

Published: 2026-09-18T15:17:19.230

Modified: 2026-09-18T19:14:56.310

Link: CVE-2026-93505

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-19T19:30:16Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')