CVE-2023-41048

Advisory

Plone.namedfile 5.6.1, 6.0.3, 6.1.3 and 6.2.1 include a fix for CVE-2023-41048: Stored Cross Site Scripting with SVG images.
https://github.com/plone/plone.namedfile/security/advisories/GHSA-jj7c-jrv4-c65x

Affected package

Affected versions

Fixed versions

Vulnerability changelog

------------------

Bug fixes:


- Fix stored XSS (Cross Site Scripting) for SVG images.
Done by forcing a download instead of displaying inline.
See `security advisory <https://github.com/plone/plone.namedfile/security/advisories/GHSA-jj7c-jrv4-c65x>`_.
[maurits] (1)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41048
• https://github.com/plone/plone.namedfile/commit/ff5269fb4c79f4eb91dd934561b8824a49a03b60
• https://github.com/plone/plone.namedfile/commit/217d6ce847b7171bf1b73fcb6c08010eb449216a
• https://github.com/plone/plone.namedfile/commit/f0f911f2a72b2e5c923dc2ab9179319cc47788f9
• https://github.com/plone/Products.PloneHotfix20210518
• https://github.com/plone/plone.namedfile/security/advisories/GHSA-jj7c-jrv4-c65x
• https://github.com/plone/plone.namedfile/commit/188f66a4577021cf8f2bf7c0f5150f9b9573f167
• http://www.openwall.com/lists/oss-security/2023/09/22/2