VulnerabilityDeferred

CVE-2025-70842

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the File Management module of FluentCMS 1.2.3.

MEDIUM 5.4EPSS 0.14%

Does this matter?

Lower severity and a low EPSS score (0.14%). Track it; it rarely justifies an emergency change on its own.

Description

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the File Management module of FluentCMS 1.2.3. The flaw allows an authenticated administrator to upload crafted SVG files containing malicious JavaScript code. Once uploaded, the script executes in the browser of any user who accesses the direct URL of the image, including unauthenticated visitors.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.14% probability · 4th percentile
CISA KEV: Not listed
Weakness: CWE-79
Source: cve@mitre.org

References

https://github.com/fluentcms/FluentCMS/issues/2404
https://github.com/fluentcms/FluentCMS/pull/2407
https://github.com/fluentcms/FluentCMS/issues/2404

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.