# CVE-2021-25978: Apostrophe CMS stored XSS in SVG uploads

Source: https://junglewise.ai/threats/cve-2021-25978-apostrophe-cms-stored-xss-in-svg-uploads  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-11-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-25978 · Severity: low · CVSS 3.1 · Published 2021-11-10

Apostrophe CMS, a content management system used to create and manage website content, contains a vulnerability where editors can upload SVG image files containing malicious scripts. When these compromised files are viewed within the media library, the embedded JavaScript executes in the browser, potentially allowing attackers to steal session tokens, modify content, or compromise administrator accounts.

Technologies: [Apostrophe CMS](https://junglewise.ai/threats/technologies/apostrophe-cms), [apostrophe (npm)](https://junglewise.ai/threats/technologies/apostrophe). Vendors: [Apostrophe](https://junglewise.ai/threats/vendors/apostrophe), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-25978 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-25978 being exploited in the wild.

**How severe is CVE-2021-25978?** Low severity, with a CVSS score of 3.1, published 10 November 2021.

**Which products and versions are affected?** Apostrophe CMS 2.63.0 to 3.3.1; apostrophe (npm) SEMVER:introduced=2.63.0,fixed=3.4.0.

**Is there a fix for CVE-2021-25978?** Yes. apostrophe (npm): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-25978 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2021-25978?** Check whether you run Apostrophe CMS or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apostrophe (npm): upgrade to 3.4.0 or later

  ```sh
  npm install apostrophe@3.4.0
  ```


## Technical details

This is a stored XSS vulnerability (CWE-79) in Apostrophe CMS's SVG file upload handler. The vulnerability exists because uploaded SVG files are not sanitized to remove embedded JavaScript before being stored and served. An authenticated user with upload permissions can craft a malicious SVG containing XSS payloads; when opened via the media library's direct link feature, the JavaScript executes in the context of the user's browser. While typical SVG display via `img` tags would not trigger the payload, direct file access bypasses this protection. The attack requires authentication (editor-level access) and user interaction (viewing the file). The fix, released in version 3.3.2 and backported versions, sanitizes all SVG uploads using DOMPurify and retroactively sanitizes previously uploaded files during deployment.

## Affected products

- Apostrophe Apostrophe CMS 2.63.0 to 3.3.1

## Identifiers

- CVE-2021-25978
- GHSA-4r9c-jghc-cx5m

## Timeline

- 2021-11-10: disclosed
- 2021-09-07: patched: Fix released in version 3.3.2

## References

- [https://github.com/apostrophecms/apostrophe/commit/c8b94ee9c79468f1ce28e31966cb0e0839165e59](https://github.com/apostrophecms/apostrophe/commit/c8b94ee9c79468f1ce28e31966cb0e0839165e59)
- [https://github.com/apostrophecms/apostrophe](https://github.com/apostrophecms/apostrophe)

## Related threats

- [ApostropheCMS unauthenticated file upload in import routes](https://junglewise.ai/threats/cve-2026-113711-apostrophecms-is-an-open-source-node-js-content-management)
- [ApostropheCMS password-change endpoint lacks attempt throttling](https://junglewise.ai/threats/cve-2026-113710-apostrophecms-no-attempt-throttling-on-authenticated-password)
- [ApostropheCMS page REST API authorization bypass](https://junglewise.ai/threats/cve-2026-113670-apostrophecms-page-rest-api-authorization-bypass)
- [ApostropheCMS cross-domain session token in URL confers session takeover](https://junglewise.ai/threats/cve-2026-113669-apostrophecms-cross-domain-session-token-in-url-confers-session)
- [ApostropheCMS REST route authorization bypass in locales endpoint](https://junglewise.ai/threats/cve-2026-113668-apostrophecms-id-locales-rest-route-omits-the-public-api)