CVE-2021-32245

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-32245
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32245.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-32245
Aliases
Published
2021-06-16T21:15:08Z
Modified
2026-07-08T21:26:56Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/exp.svg" that will point to http://localhost/pagekit/storage/exp.svg. When a user comes along to click that link, it will trigger a XSS attack.

References

Affected packages

Git / github.com/pagekit/pagekit

Affected ranges

Type
GIT
Repo
https://github.com/pagekit/pagekit
Events
Introduced
95446c5f08fc43993fad5e2b581743ffcce50c35
Last Affected
95446c5f08fc43993fad5e2b581743ffcce50c35
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:pagekit:pagekit:1.0.18:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.0.18"
        },
        {
            "last_affected": "1.0.18"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

1.*
1.0.18

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32245.json"