CVE-2026-30117

CriticalCVSS 9.8

Published: 19/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.53%

41th percentile - higher than 41% of all known CVEs

Summary

In scalar/astro v0.1.13, an arbitrary file upload vulnerability exists via the scalar_url parameter of the Scalar Proxy endpoint. An attacker can upload a crafted SVG file, leading to arbitrary code execution.

Risk Assessment

An attacker can remotely execute arbitrary code on the server by uploading a malicious SVG file.

Recommendation

Update scalar/astro to a version after 0.1.13 or apply the available patch.

Original NVD description (English source)

scalar/astro v0.1.13 was discovered to contain an arbitrary file upload vulnerability in the the scalar_url query parameter of the Scalar Proxy endpoint. This vulnerability allows attackers to execute arbitrary code via uploading a crafted SVG file.