Executive brief
CMS Made Simple is a content management system used to build and manage websites. A security flaw allows users with content editing permissions to upload malicious image files that contain hidden scripts. If another administrator or user views these files, the scripts can run automatically, potentially allowing the attacker to steal login sessions or take over other accounts.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in CMS Made Simple versions up to and including 2.2.15. The flaw is located in the File Manager component, which fails to properly sanitize or validate the contents of uploaded SVG files. An authenticated attacker with 'Content Manager' privileges can upload an SVG file containing an embedded <script> block. When another user (such as a site administrator) views the uploaded file via the web interface, the malicious JavaScript executes in the context of their session. This can lead to session hijacking, cookie theft, and unauthorized actions performed on behalf of the victim. While the vendor has released newer versions (e.g., 2.2.22), users should ensure they are running a version that restricts SVG script execution or sanitizes file uploads.
Affected products
- CMS Made Simple CMS Made Simple <= 2.2.15
Timeline
- 2020-12-04: disclosed: Initial exploit published on Exploit-DB
- 2026-05-16: advisory: NVD/VulnCheck advisory published