plone namedfile vulnerabilities

Latest plone namedfile CVEs

Newest publication first

1. CVE-2023-41048 plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images

   Published 2023-09-21

   Medium·CVSS 5.4 EPSS 0.57%

   plone.namedfile allows users to handle File and Image fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross site scripting vulnerability for SVG images. A security hotfix from 2021 already partia...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.