CVE-2021-25971 MEDIUM

CVE-2021-25971: Camaleon CMS - SVG File Upload Creates DoS for Media Upload Feature

Vendor Camaleon_Cms
Product camaleon_cms
Weakness CWE-248
Published October 20, 2021
Last update April 30, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file

Key dates

02Disclosure timeline

October 20, 2021 CVE published
April 30, 2025 Record updated