GHSA-ffq7-898w-9jc4
High · 8.0DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload
CVSS
8.0
EPSS
—
Published
Apr 10, 2026
CISA due date
—
The record
A user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased if the scripts are run by a power user.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-40321 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the… Same vulnerability
- CVE-2026-54002 Kirby is an open-source content management system. CWE-87
- CVE-2026-55661 Tina is a headless content management system. CWE-87
- GHSA-2vcc-5v34-9jc8 TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing… CWE-87
- CVE-2026-46492 md-fileserver allows for local viewing of markdown files in a browser. CWE-87
- CVE-2026-25688 Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer. CWE-87
- GHSA-32q2-hhr5-6qvv md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed) CWE-87
- CVE-2026-45314 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… CWE-87