CVE-2024-8378: Safe SVG < 2.2.6 - Author+ SVG Sanitisation Bypass
Published Nov 7, 2024
·Updated
The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wphandleupload, but not for example for code that uses wphandlesideload which is often used to upload attachments via raw POST data.
Affected Software
2 affected components
10up Safe Svg Wordpress<2.2.6
Safe SVG Safe SVG<2.2.6
Event History
Nov 7, 2024
CVE Published
via MITRE·03:07 PM
Data Sourced
via MITRE·03:07 PM
DescriptionWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2024-8378?
CVE-2024-8378 has a moderate severity rating due to its potential impact on file uploads.
2
How do I fix CVE-2024-8378?
To fix CVE-2024-8378, update the Safe SVG plugin to version 2.2.6 or later.
3
What does CVE-2024-8378 affect?
CVE-2024-8378 affects the Safe SVG WordPress plugin versions before 2.2.6.
4
What is the nature of the vulnerability in CVE-2024-8378?
The vulnerability in CVE-2024-8378 involves inadequate sanitization of uploaded SVG files using wp_handle_sideload.
5
Who is affected by CVE-2024-8378?
Any WordPress site using the Safe SVG plugin before version 2.2.6 is potentially affected by CVE-2024-8378.