Skip to content
Sign in
Not rated

CVE-2022-1091 The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the…

Description

The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly XSS, but depending on further use of uploaded SVG files potentially other XML attacks).

Affected products and versions

Product Affected versions Fixed in
Safe SVG 1.9 earliest → < 1.9.10 1.9.10

Other CVEs of Safe SVG

The 2 CVEs of Safe SVG →
CVE-2024-8378 The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call… 4.8 Medium
Track this CVE