CVE-2025-63830

CKFinder v1.4.3 is vulnerable to Stored Cross-Site Scripting (XSS) due to a lack of proper sanitization in the File Upload function. An attacker can upload a specially crafted SVG file containing active content, such as [removed] tags, onload handlers, or elements. When a victim subsequently acc...