PluXml CMS Stored Cross-Site Scripting Vulnerability in File Uploading Functionality

A stored cross-site scripting vulnerability has been identified in PluXml CMS versions 5.8.21 and 5.9.0-rc7. The issue arises in the file uploading feature, where an authenticated attacker can upload an SVG file embedded with a malicious payload. This payload is executed when a victim clicks the link to the uploaded image. In version 5.9.0-rc7, the malicious code does not execute upon clicking the image link, but can still be triggered by directly accessing the file. While versions 5.8.21 and 5.9.0-rc7 have been confirmed vulnerable, other versions may also be affected.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded SVG files containing malicious scripts are executed in the context of the user viewing the file.