CVE-2021-47958 — CouchCMS 2.2.1 Server-Side Request Forgery via SVG upload
CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SVG files. Attacke…
Published: 2026-05-15 · CVSS: 5.3 · CVSS 4.0
CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SVG files. Attackers can upload SVG files containing external entity references through the browse.php endpoint to access internal services and resources.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7