Winter CMS SVG Upload Sanitization Vulnerability in Asset Manager

A vulnerability in Winter CMS versions prior to 1.2.10 allows users with the 'cms.manage_assets' permission to upload SVG files through the Asset Manager without automatic sanitization. This lack of sanitization could be exploited by an attacker with access to the Backend and the appropriate permissions.

Impact

The vulnerability could lead to the upload of malicious SVG files that are not properly sanitized, potentially allowing for the execution of harmful scripts or code.

Remediation

Users can upgrade to Winter CMS version 1.2.10 or apply the patch available in commit 8a7f74b004fcd19721764fc63af0cdb339d9fb65 to manually resolve this issue.