CVE-2024-13141

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-13141
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-13141.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-13141
Published
2025-01-05T14:31:04.572Z
Modified
2026-08-12T03:51:16.482500611Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
osuuu LightPicture SVG File Upload upload cross site scripting
Details

A vulnerability classified as problematic was found in osuuu LightPicture up to 1.2.2. This vulnerability affects unknown code of the file /api/upload of the component SVG File Upload Handler. The manipulation of the argument file leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Database specific 
{
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13141.json",
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.2.0"
                },
                {
                    "last_affected": "1.2.0"
                },
                {
                    "introduced": "1.2.1"
                },
                {
                    "last_affected": "1.2.1"
                },
                {
                    "introduced": "1.2.2"
                },
                {
                    "last_affected": "1.2.2"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/osuuu/lightpicture

Affected ranges

Type
GIT
Repo
https://github.com/osuuu/lightpicture
Events
Introduced
d39f6525e94cf3fed531625dedf1d82926baa553
Last affected
631877c18ee715ea35589c130e3551651d83505b
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:osuuu:lightpicture:1.2.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:osuuu:lightpicture:1.2.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:osuuu:lightpicture:1.2.2:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "1.2.0"
        },
        {
            "last_affected": "1.2.0"
        },
        {
            "introduced": "1.2.1"
        },
        {
            "last_affected": "1.2.1"
        },
        {
            "introduced": "1.2.2"
        },
        {
            "last_affected": "1.2.2"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

1.*
1.2.0
1.2.2
v1.*
v1.2.0
v1.2.1
v1.2.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-13141.json"