EUVD-2024-3089

🗓️ 03 Oct 2025 20:07:09Reported by EUVDType

Contao allows admin upload of SVG files containing malicious JavaScript code, posing security risk.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-45965	2 Oct 202423:03	–	circl
CNNVD	Contao 代码问题漏洞	2 Oct 202400:00	–	cnnvd
CVE	CVE-2024-45965	2 Oct 202400:00	–	cve
Cvelist	CVE-2024-45965	2 Oct 202400:00	–	cvelist
Github Security Blog	Duplicate Advisory: Contao allows admin an account to upload SVG file containing malicious JavaScript	2 Oct 202421:30	–	github
NVD	CVE-2024-45965	2 Oct 202420:15	–	nvd
OSV	GHSA-MRW8-5368-PHM3 Duplicate Advisory: Contao allows admin an account to upload SVG file containing malicious JavaScript	2 Oct 202421:30	–	osv
Positive Technologies	PT-2024-31859	2 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-45965	24 Mar 202520:18	–	redhatcve
Veracode	Cross-site Scripting (XSS)	3 Oct 202411:32	–	veracode

[
  {
    "enisaIdVendor": [
      {
        "id": "8842ef2f-3df1-3f33-a7ea-ddfc4aa17b93",
        "vendor": {
          "name": "contao"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "0e01fc1b-71f3-37d4-951c-93545d5085b2",
        "product": {
          "name": "contao"
        },
        "product_version": "5.0.0 <5.3.30"
      },
      {
        "id": "2f69603a-9cf4-32e0-9b53-075e7f15d39a",
        "product": {
          "name": "contao"
        },
        "product_version": "4.0.0 <4.13.54"
      },
      {
        "id": "b0668da7-4249-3308-a2ab-79febf5c58b2",
        "product": {
          "name": "contao"
        },
        "product_version": "5.4.0 <5.5.6"
      }
    ]
  }
]

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-45965
github	www.github.com/contao/contao
grimthereaperteam	www.grimthereaperteam.medium.com/contao-5-4-1-malicious-file-upload-xss-in-svg-30edb8820ecb
contao	www.contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads

03 Oct 2025 20:07Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.14.7 - 6.4

EPSS0.00343

SSVC