Executive brief
FluentCMS is a content management system used to build and manage websites. A security flaw in its file management system allows users with administrative access to upload malicious image files (SVGs) containing hidden scripts. If a visitor or another administrator views the direct link to one of these images, the hidden script will run in their browser, potentially allowing an attacker to hijack sessions, redirect users to malicious sites, or perform unauthorized actions.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the File Management module of FluentCMS version 1.2.3. The application fails to sanitize SVG files during the upload process, allowing authenticated administrators to embed malicious JavaScript within SVG elements or event handlers (e.g., <script> tags or 'onload' attributes). Because these files are stored in a public directory and served without restrictive security headers, the payload executes in the context of any user—including unauthenticated visitors—who navigates to the direct URL of the uploaded file. A fix has been proposed in pull request #2407 which introduces server-side SVG sanitization using System.Xml.Linq to strip dangerous elements and attributes.
Affected products
- FluentCMS FluentCMS 1.2.3
Timeline
- 2026-01-01: disclosed: Issue reported on GitHub by jaroslaw-wawiorko
- 2026-03-30: patched: Pull request #2407 created to address the vulnerability
- 2026-05-12: advisory: CVE-2025-70842 published