VULNERABILITY INTELLIGENCE

CVE-2021-25978

CVSS score5.4 MEDIUM
EPSS probability0.50%
CISA KEVNot currently listed
Published2021-11-07
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed.

Weakness classification

  • vulnerabilitylab@mend.io: CWE-79
  • nvd@nist.gov: CWE-79

Primary references