Description
Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | tikiwiki/tiki-manager | <= 17.1 | — | GHSA-7f2f-crxg-cpfv |
Medium · 5.4
CVE-2018-7302
EUVD-2022-2978GHSA-7f2f-crxg-cpfv
Tiki Wiki CMS XSS Vulnerability
Published Feb 21, 2018 · Updated Sep 16, 2024 · Assigned by mitre