Executive brief
CouchCMS, a content management system designed for web designers, is vulnerable to a security flaw in its file upload system. An authenticated user can upload a specially crafted image file (SVG) containing malicious code. When other users or administrators view or preview this file, the code executes in their browser, potentially allowing the attacker to steal session information or perform actions on behalf of the victim.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in CouchCMS 2.2.1 due to improper sanitization of uploaded SVG files. Authenticated attackers can utilize the file upload functionality at the /couch/includes/kcfinder/browse.php endpoint to upload SVG files containing embedded <script> tags. Because the application fails to strip JavaScript from SVG XML data, the script executes in the context of any user who subsequently accesses or previews the file. This can lead to session hijacking via cookie theft or unauthorized administrative actions. The vulnerability was originally identified in the KCFinder integration used by the CMS.
Affected products
- CouchCMS CouchCMS 2.2.1
Timeline
- 2021-01-25: disclosed: Initial discovery by researcher xxcdd
- 2021-03-11: other: Exploit published on Exploit-DB
- 2026-05-16: advisory: CVE published/updated via VulnCheck and NVD