Workflow

PyPi: Piccolo-Admin

CVE-2024-30248

Safety vulnerability ID: 70646

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at Apr 02, 2024 Updated at Nov 29, 2024
Scan your Python projects for vulnerabilities →

Advisory

Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin page. This vulnerability was patched in version 1.3.2. See CVE-2024-30248.

Affected package

piccolo-admin

Latest version: 1.9.0

A powerful and modern admin interface / CMS, powered by Piccolo and ASGI.

Affected versions

Fixed versions

Vulnerability changelog

Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin page. This vulnerability was patched in version 1.3.2. See CVE-2024-30248.


MISC:https://github.com/piccolo-orm/piccolo_admin/commit/c419575c2467959d906154084d305648eb2b8faf: https://github.com/piccolo-orm/piccolo_admin/commit/c419575c2467959d906154084d305648eb2b8faf
MISC:https://github.com/piccolo-orm/piccolo_admin/security/advisories/GHSA-pmww-v6c9-7p83: https://github.com/piccolo-orm/piccolo_admin/security/advisories/GHSA-pmww-v6c9-7p83

Resources

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application