What’s Vulnerable › Vulnerabilities

CVE-2023-46857

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-12-07 · updated 2026-06-17
• Weakness: CWE-79

Description

Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for exploitation.

Affected products

• squidex: before 7.9.0 — fixed in 7.9.0

How to fix

Upgrade to a fixed version: squidex 7.9.0. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2023/11/08/4
• https://census-labs.com/news/2023/11/08/weak-svg-asset-filtering-mechanism-in-squidex-cms/
• https://support.squidex.io/c/news/9
• http://www.openwall.com/lists/oss-security/2023/11/08/4
• https://census-labs.com/news/2023/11/08/weak-svg-asset-filtering-mechanism-in-squidex-cms/
• https://support.squidex.io/c/news/9

Get alerted when CVE-2023-46857 or the next vulnerability affects your stack