CVE-2025-70842

{
  "id": "CVE-2025-70842",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T15:16:12.163",
  "lastModified": "2026-11-04T20:10:00.263",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the File Management module of FluentCMS 1.2.3. The flaw allows an authenticated administrator to upload crafted SVG files containing malicious JavaScript code. Once uploaded, the script executes in the browser of any user who accesses the direct URL of the image, including unauthenticated visitors."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de cross-site scripting (XSS) almacenado fue descubierta en el módulo de Gestión de Archivos de FluentCMS 1.2.3. La falla permite a un administrador autenticado cargar archivos SVG manipulados que contienen código JavaScript malicioso. Una vez cargado, el script se ejecuta en el navegador de cualquier usuario que acceda a la URL directa de la imagen, incluidos los visitantes no autenticados."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-12T15:40:58.647073Z",
          "id": "CVE-2025-70842",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/fluentcms/FluentCMS/issues/2404",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/fluentcms/FluentCMS/pull/2407",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/fluentcms/FluentCMS/issues/2404",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}