CVE-2021-43841

    Dashboard / Vulnerabilities / CVE-2021-43841

    CVE-2021-43841

    Published: 4 Feb 2022Last Modified: 24 Oct 2026

    Summary:

    Details: XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files.

    References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9jq9-c2cv-pcrj, https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Attachments#HAttachmentdisplayordownload, https://github.com/xwiki/xwiki-platform/commit/5853d492b3a274db0d94d560e2a5ea988a271c62, https://jira.xwiki.org/browse/XWIKI-18368

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 93d8322eda7b68fd66f33334b982b047d7cf4f36
    Fixed -c8ef54e5edad98883ec37bea18edb78c39215348

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-43841 | CVE-DB