CVE-2023-41048 plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images

🗓️ 21 Sep 2023 14:31:07Reported by GoogleType

osv🔗 osv.dev👁 20 Views

plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross site scripting vulnerability for SVG images

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2023-41048	21 Sep 202318:31	–	circl
CNNVD	Plone Cross-Site Scripting Vulnerability	21 Sep 202300:00	–	cnnvd
CVE	CVE-2023-41048	21 Sep 202314:31	–	cve
Cvelist	CVE-2023-41048 plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images	21 Sep 202314:31	–	cvelist
EUVD	EUVD-2023-2537	3 Oct 202520:07	–	euvd
Github Security Blog	plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images	21 Sep 202317:14	–	github
NVD	CVE-2023-41048	21 Sep 202315:15	–	nvd
OSV	GHSA-JJ7C-JRV4-C65X plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images	21 Sep 202317:14	–	osv
OSV	PYSEC-2023-311	21 Sep 202315:15	–	osv
Tenable Nessus	Plone Python Library Multiple Vulnerabilities (20230921)	4 Mar 202600:00	–	nessus

Source	Link
openwall	www.openwall.com/lists/oss-security/2023/09/22/2
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41048.json
github	www.github.com/plone/plone.namedfile/security/advisories/GHSA-jj7c-jrv4-c65x
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-41048
github	www.github.com/plone/plone.namedfile/commit/188f66a4577021cf8f2bf7c0f5150f9b9573f167
github	www.github.com/plone/plone.namedfile/commit/217d6ce847b7171bf1b73fcb6c08010eb449216a
github	www.github.com/plone/plone.namedfile/commit/f0f911f2a72b2e5c923dc2ab9179319cc47788f9
github	www.github.com/plone/plone.namedfile/commit/ff5269fb4c79f4eb91dd934561b8824a49a03b60
github	www.github.com/plone/Products.PloneHotfix20210518

10 Apr 2026 05:01Current

5Medium risk

Vulners AI Score5

CVSS 3.13.7

EPSS0.00503