GHSA-69hx-63pv-f8f4
Medium · 4.8Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload
CVSS
4.8
EPSS
—
Published
Apr 10, 2026
CISA due date
—
The record
The file upload endpoint validates Content-Type using only the client-supplied multipart header, with no server-side content inspection or file extension validation. Combined with an unauthenticated static file server that determines Content-Type from file extension, this allows an admin to upload HTML/SVG files containing JavaScript that execute in the application's origin when visited by any user. Additionally, `image/svg+xml` is in the default allowed types, enabling stored XSS via SVG without any Content-Type spoofing.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-8778 The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. CWE-434
- CVE-2026-12215 The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication… CWE-434
- CVE-2026-18351 The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to… CWE-434
- CVE-2026-71805 An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. CWE-434
- CVE-2026-26212 Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file… CWE-434
- CVE-2026-54611 InstantCMS is a free and open source content management system. CWE-434
- CVE-2026-86666 A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. CWE-434
- CVE-2026-50093 A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions <… CWE-434