CVE-2026-93506
MediumCVSS 6.3Summary
A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called 05b4f9efeb79e9d72a693232334d7529687f896f. It is best practice to apply a patch to resolve this issue.
Risk Assessment
An attacker can force the server to make requests to internal or external resources, potentially leading to information disclosure or access to internal services.
Recommendation
Apply patch 05b4f9efeb79e9d72a693232334d7529687f896f in SveltyCMS and restrict outbound requests from the server.
Other vulnerabilities in SveltyCMS
See all- CVE-2026-93505Low
SveltyCMS 0.0.6 contains a cross-site scripting (XSS) vulnerability in the SVG Media Upload component, in the file src/utils/media/media-service.server.ts. Input manipulation can lead to malicious script execution, and the attack can be initiated remotely.
- CVE-2026-93504Medium
A vulnerability in SveltyCMS 0.0.6 in the user attribute update endpoint allows improper access controls, letting a remote attacker modify user attributes without authorization. A patch is available as commit 05b4f9efeb79e9d72a693232334d7529687f896f.
Original NVD description (English source)
A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called 05b4f9efeb79e9d72a693232334d7529687f896f. It is best practice to apply a patch to resolve this issue.