CVE-2022-24749

    Dashboard / Vulnerabilities / CVE-2022-24749

    CVE-2022-24749

    Published: 14 Mar 2022Last Modified: 21 Oct 2026

    Summary: Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius

    Details: Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting (XSS) code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the IMG tag. The problem applies both to the files opened on the admin panel and shop pages. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. As a workaround, require a library that adds on-upload file sanitization and overwrite the service before writing the file to the filesystem. The GitHub Security Advisory contains more specific information about the workaround.

    References: https://github.com/Sylius/Sylius/releases/tag/v1.10.11, https://github.com/Sylius/Sylius/releases/tag/v1.11.2, https://github.com/Sylius/Sylius/releases/tag/v1.9.10, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24749.json, https://github.com/Sylius/Sylius/security/advisories/GHSA-4qrp-27r3-66fj, https://nvd.nist.gov/vuln/detail/CVE-2022-24749

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d7b8773600e69ccbcd6d498a77b98241c0049978

    Affected versions

    v1.11.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-24749 | CVE-DB