-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how user portraits (including SVGs) were served. The commit diff shows the patched version added Content-Disposition headers and MIME type checks to force downloads for SVG files. The unpatched PortraitGet.render() method would serve SVGs with 'inline' disposition, allowing XSS when the SVG is directly viewed in a browser. The presence of SVG-specific security logic in the patch directly correlates to the vulnerability description about unsafe inline rendering of user-uploaded SVGs.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| plone.restapi | pip | >= 8.0.0, < 8.43.3 | 8.43.3 |
PythonPython