CVE-2024-30248: Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-02 · updated 2026-06-17
Weakness: CWE-79

Description

Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin page. This vulnerability was patched in version 1.3.2.

Affected products

piccolo-orm piccolo_admin: from 1.2.0 before 1.3.2 — fixed in 1.3.2

How to fix

Upgrade to a fixed version: piccolo-orm piccolo_admin 1.3.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-30248 or the next vulnerability affects your stack