CVE-2026-93505
LowCVSS 3.5Summary
SveltyCMS 0.0.6 contains a cross-site scripting (XSS) vulnerability in the SVG Media Upload component, in the file src/utils/media/media-service.server.ts. Input manipulation can lead to malicious script execution, and the attack can be initiated remotely.
Risk Assessment
An attacker can remotely inject malicious JavaScript that executes in the victim's browser, potentially leading to session or data theft. This can compromise the security of the application and its users.
Recommendation
Apply the patch identified as 05b4f9efeb79e9d72a693232334d7529687f896f, which fixes this vulnerability. Update SveltyCMS to a version containing this patch.
Other vulnerabilities in SveltyCMS
See all- CVE-2026-93506Medium
A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called 05b4f9efeb79e9d72a693232334d7529687f896f. It is best practice to apply a patch to resolve this issue.
- CVE-2026-93504Medium
A vulnerability in SveltyCMS 0.0.6 in the user attribute update endpoint allows improper access controls, letting a remote attacker modify user attributes without authorization. A patch is available as commit 05b4f9efeb79e9d72a693232334d7529687f896f.
Original NVD description (English source)
A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG Media Upload. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The patch is named 05b4f9efeb79e9d72a693232334d7529687f896f. Applying a patch is the recommended action to fix this issue.