CVE-2021-47958
CouchCMS 2.2.1 Server-Side Request Forgery via SVG upload
- State
- Published
- Severity
- 5.3 Medium
- Published
- May 15, 2026
- Updated
- May 15, 2026
- Reserved
- Feb 1, 2026
Description
CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SVG files. Attackers can upload SVG files containing external entity references through the browse.php endpoint to access internal services and resources.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N | VulnCheck |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
CouchCMSCouchCMS |
|
References
- ExploitDB-49675exploit
- Official Product Homepageproduct
- VulnCheck Advisory: CouchCMS 2.2.1 Server-Side Request Forgery via SVG uploadthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.