CVE-2026-94672

MediumCVSS 4.3

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

Safe SVG plugin version 2.5.0 and earlier contains an Insecure Direct Object References (IDOR) vulnerability exploitable by contributors, allowing unauthorized access to resources.

Risk Assessment

Risk of unauthorized access to data or functionality that should be restricted to contributors.

Recommendation

Update the Safe SVG plugin to the latest available version that includes the fix.

Other vulnerabilities in Safe SVG

CVE-2026-94077Medium
Safe SVG plugin version 2.5.0 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by contributors, allowing injection of malicious scripts.

Original NVD description (English source)

Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS