CVE-2025-61417: XSS
Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/mediamanager component. Attackers can upload a malicious SVG file containing JavaScript code. When an administrator previews the file, the code executes in their browser context, allowing the attacker to perform unauthorized actions such as modifying the admin account credentials.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61417?
CVE-2025-61417 is a cross-site scripting (XSS) vulnerability with a medium to high severity level.
How do I fix CVE-2025-61417?
To fix CVE-2025-61417, upgrade TastyIgniter to version 3.7.8 or later, where the vulnerability is addressed.
Can CVE-2025-61417 be exploited remotely?
Yes, CVE-2025-61417 can be remotely exploited by uploading a malicious SVG file to the media manager.
Which components of TastyIgniter are affected by CVE-2025-61417?
CVE-2025-61417 affects the /admin/media_manager component of TastyIgniter version 3.7.7.
What impact does CVE-2025-61417 have on administrators?
Administrators who preview the malicious SVG file may unknowingly execute the attacker's JavaScript code in their browser.