GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
GHSA-fm53-mpmp-7qw2high8.7

Possible cross-site scripting attack via unsanitized SVG files in FoF Upload

Check your stack

The advisory, in context

Impact

If FoF Upload is configured to allow the uploading of SVG files (image/svg+xml), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker.

This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously.

Patches

This has been patched with v1.2.3, which now sanitizes uploaded SVG files.

Workarounds

Upgrade to 1.2.3 (requires Flarum 1.2 or later), or remove the ability for users to upload SVG files through FoF Upload.

References

Thank you to Safwat Refaat for the responsible disclosure of this vulnerability.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

fof/upload Packagist
Ecosystem versions

Earlier releases before 1.2.3

Fixed in 1.2.3

86 explicitly affected versions

0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.10.0, 0.10.1, 0.11, 0.11.1, 0.11.2, 0.11.3, 0.12.0, 0.12.1, 0.12.10, 0.12.2, 0.12.3, 0.12.4, 0.12.5, 0.12.6, 0.12.7, 0.12.8, 0.12.9, 0.13.0, 0.13.1, 0.14.0, 0.14.0-beta, 0.14.0-beta.1, 0.2.0, 0.2.1, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.3.7, 0.3.8, 0.4.0, 0.4.1, 0.4.10, 0.4.11, 0.4.12, 0.4.13, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7, 0.4.8, 0.4.9, 0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7, 0.6.0, 0.6.0-beta, 0.7.0, 0.7.0-beta.1, 0.7.0-beta.2, 0.7.1, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.5, 0.9.0, 0.9.1, 0.9.2, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.1.0, 1.2.0, 1.2.1, 1.2.2

View affected-version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.2.3"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.1.0",
    "0.1.1",
    "0.1.2",
    "0.1.3",
    "0.10.0",
    "0.10.1",
    "0.11",
    "0.11.1",
    "0.11.2",
    "0.11.3",
    "0.12.0",
    "0.12.1",
    "0.12.10",
    "0.12.2",
    "0.12.3",
    "0.12.4",
    "0.12.5",
    "0.12.6",
    "0.12.7",
    "0.12.8",
    "0.12.9",
    "0.13.0",
    "0.13.1",
    "0.14.0",
    "0.14.0-beta",
    "0.14.0-beta.1",
    "0.2.0",
    "0.2.1",
    "0.3.0",
    "0.3.1",
    "0.3.2",
    "0.3.3",
    "0.3.4",
    "0.3.5",
    "0.3.6",
    "0.3.7",
    "0.3.8",
    "0.4.0",
    "0.4.1",
    "0.4.10",
    "0.4.11",
    "0.4.12",
    "0.4.13",
    "0.4.2",
    "0.4.3",
    "0.4.4",
    "0.4.5",
    "0.4.6",
    "0.4.7",
    "0.4.8",
    "0.4.9",
    "0.5.0",
    "0.5.1",
    "0.5.2",
    "0.5.3",
    "0.5.4",
    "0.5.5",
    "0.5.6",
    "0.5.7",
    "0.6.0",
    "0.6.0-beta",
    "0.7.0",
    "0.7.0-beta.1",
    "0.7.0-beta.2",
    "0.7.1",
    "0.8.0",
    "0.8.1",
    "0.8.2",
    "0.8.3",
    "0.8.4",
    "0.8.5",
    "0.9.0",
    "0.9.1",
    "0.9.2",
    "1.0.0",
    "1.0.1",
    "1.0.2",
    "1.0.3",
    "1.0.4",
    "1.0.5",
    "1.0.6",
    "1.0.7",
    "1.1.0",
    "1.2.0",
    "1.2.1",
    "1.2.2"
  ]
}

References