chevereto vulnerabilities

Products

• chevereto 7
• chevereto/chevereto 1
• rodber/chevereto-free 1

Latest chevereto CVEs

Newest publication first

1. CVE-2026-122326 Chevereto before 4.5.8 Private Album Image Disclosure via get-album-contents

   Published 2026-11-05

   Medium·CVSS 6.9 EPSS 0.52%

   Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from any public page and an...

2. CVE-2026-55417 Chevereto private profile setting leaks username on /json endpoint

   Published 2026-07-07

   Medium·CVSS 6.9 EPSS 0.42%

   Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route (/username) correctly returns 404. However, the /json AJAX listing endpoint does not apply th...

3. CVE-2021-31721 Chevereto before 3.17.1 allows Cross Site Scripting (XSS) via an image title at the image upload stage.

   Published 2021-06-30

   Medium·CVSS 6.1 EPSS 0.89%

   Chevereto before 3.17.1 allows Cross Site Scripting (XSS) via an image title at the image upload stage.

4. CVE-2018-12030 Chevereto Free before 1.0.13 has XSS.

   Published 2018-06-15

   Medium·CVSS 5.4 EPSS 0.65%

   Chevereto Free before 1.0.13 has XSS.

5. CVE-2017-1000058 Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user profile and one in the Exif data parser.

   Published 2017-07-13

   Medium·CVSS 6.1 EPSS 0.73%

   Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user profile and one in the Exif data parser.

6. CVE-2012-2919 Directory traversal vulnerability in Upload/engine.php in Chevereto 1.9.1 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in the v parameter.

   Published 2012-05-21

   Medium·CVSS 5.0 EPSS 3.3% Public exploit

   Directory traversal vulnerability in Upload/engine.php in Chevereto 1.9.1 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in the v parameter.

7. CVE-2012-2918 Cross-site scripting (XSS) vulnerability in Upload/engine.php in Chevereto 1.91 allows remote attackers to inject arbitrary web script or HTML via the v parameter.

   Published 2012-05-21

   Medium·CVSS 4.3 EPSS 1.6% Public exploit

   Cross-site scripting (XSS) vulnerability in Upload/engine.php in Chevereto 1.91 allows remote attackers to inject arbitrary web script or HTML via the v parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.