CVE-2024-30248

Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin page. This vulnerability was patched in version 1.3.2.

Affected

piccolo-orm · piccolo_admin

CVSS v3.1 GITHUB

7.7 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

EPSS

0.49% chance of exploitation in the next 30 days, 41st percentile

Published

2024-04-02

Updated

2024-08-02

Proof-of-concept exploits (1)

• advisories/GHSA-pmww-v6c9-7p83

References

• CVE Record
• NVD entry