{"id":"GHSA-7f2f-crxg-cpfv","aliases":["CVE-2018-7302"],"title":"Tiki Wiki CMS XSS Vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS.","severity":"medium","score":5.4,"published":"2022-05-14T03:38:59.000Z","modified":"2026-09-10T03:49:38.147Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"tikiwiki/tiki-manager","sources":[{"name":"OSV · GHSA-7f2f-crxg-cpfv","url":"https://osv.dev/vulnerability/GHSA-7f2f-crxg-cpfv"}],"ranges":[{"events":[{"introduced":"0"},{"last_affected":"17.1"}],"type":"ECOSYSTEM"}],"versions":["v0.1.0","v0.1.1","v0.1.2"],"fixed":[]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2018-7302","https://github.com/TikiWiki/tiki-manager","https://websecnerd.blogspot.in/2018/01/tiki-wiki-cms-groupware-17.html"],"sources":[{"name":"OSV","id":"GHSA-7f2f-crxg-cpfv","modified":"2026-09-10T03:49:38.147308165Z","url":"https://osv.dev/vulnerability/GHSA-7f2f-crxg-cpfv"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T00:30:33.731Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}