sveltycms vulnerabilities

Products

• sveltycms 3

Latest sveltycms CVEs

Newest publication first

1. CVE-2026-93506 SveltyCMS File Upload Endpoint upload-media server-side request forgery

   Published 2026-09-18

   Medium·CVSS 5.3 EPSS 0.37%

   A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This...

2. CVE-2026-93505 SveltyCMS SVG Media Upload media-service.server.ts cross site scripting

   Published 2026-09-18

   Medium·CVSS 5.1 EPSS 0.35%

   A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG Media Upload. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The patch...

3. CVE-2026-93504 SveltyCMS User Attribute Update Endpoint +server.ts access control

   Published 2026-09-18

   Medium·CVSS 5.3 EPSS 0.37%

   A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/[...path]/+server.ts of the component User Attribute Update Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.