CVE-2021-25978

Apostrophe - XSS

State: Published
Severity: 5.4 Medium
Published: Nov 7, 2021
Updated: Apr 30, 2025
Reserved: Jan 22, 2021

Description

Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	Mend

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
ApostropheApostrophe	3.3.1 and earlierAffected 2.63.0 to before unspecifiedAffected

References

https://github.com/apostrophecms/apostrophe/commit/c8b94ee9c79468f1ce28e31966cb0e0839165e59

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.