Executive brief
FluentCMS, a content management system, contains a security flaw in its file management system. An authorized administrator can upload specially crafted image files (SVG) containing hidden malicious scripts. When other users or visitors view these images, the scripts execute in their browsers, potentially allowing for unauthorized actions, website manipulation, or redirection to malicious sites.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the File Management module of FluentCMS versions up to 0.0.5. The application fails to sanitize SVG file uploads, which can contain embedded <script> tags. An authenticated administrator can upload a malicious SVG file that, when accessed via its public URL, executes arbitrary JavaScript in the context of the victim's browser session. This occurs because the files are served from a public directory without restrictive security headers. The vulnerability is tracked as CVE-2025-15549 and requires administrative privileges to exploit.
Affected products
- FluentCMS FluentCMS up to and including 0.0.5
Timeline
- 2026-01-01: disclosed: Issue reported on GitHub by researcher
- 2026-01-29: advisory: NVD and VulnCheck published advisory