{"id":"CVE-2024-45965","details":"Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6.","modified":"2026-08-12T03:51:35.352297303Z","published":"2024-10-02T00:00:00Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"4.0.0"},{"fixed":"4.13.54"},{"introduced":"5.0.0"},{"fixed":"5.3.30"},{"introduced":"5.4.0"},{"fixed":"5.5.6"}],"source":"AFFECTED_FIELD"},{"source":"CPE_FIELD","extracted_events":[{"introduced":"4.0.0"},{"fixed":"4.13.54"},{"introduced":"5.0.0"},{"fixed":"5.3.30"},{"introduced":"5.4.0"},{"fixed":"5.5.6"}]},{"source":"DESCRIPTION","extracted_events":[{"fixed":"5.5.6"},{"introduced":"4.x"},{"fixed":"4.13.54"},{"introduced":"5.0.x"},{"fixed":"5.3.x"},{"fixed":"5.3.30"},{"introduced":"5.5..x"},{"fixed":"5.5.6"}]}],"cna_assigner":"mitre","cwe_ids":["CWE-434"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45965.json"},"references":[{"type":"WEB","url":"https://grimthereaperteam.medium.com/contao-5-4-1-malicious-file-upload-xss-in-svg-30edb8820ecb"},{"type":"ADVISORY","url":"https://contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45965.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45965"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/contao/contao","events":[{"introduced":"84b2fe637d5ead531f117f26b48d1b9de8df4074"},{"fixed":"98274a6b07f4877dc369ee7975f9c256c54dd576"},{"introduced":"8cb541c59cb07ecb62fc5c5685c6448f38b97ad8"},{"fixed":"1899dd416c9849eab1b1ed5c89cfbb9785de8f22"},{"introduced":"3173ec39227e5454439be24f7169bad5e0eb69f8"},{"fixed":"62b1b973fbc36fbbd834ee611972bcadaf5c82d6"}],"database_specific":{"cpe":"cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.0"},{"fixed":"4.13.54"},{"introduced":"5.0.0"},{"fixed":"5.3.30"},{"introduced":"5.4.0"},{"fixed":"5.5.6"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45965.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}]}