CVE-2023-53900 — Spip 4.1.10 Admin Account Spoofing via Malicious SVG Upload
Spip 4.1.10 contains a file upload vulnerability that allows attackers to upload malicious SVG files with embedded external links. Attackers can trick administrators into clicki…
Published: 2025-12-16 · CVSS: 4.8 · CVSS 4.0
Spip 4.1.10 contains a file upload vulnerability that allows attackers to upload malicious SVG files with embedded external links. Attackers can trick administrators into clicking a crafted SVG logo that redirects to a potentially dangerous URL through improper file upload filtering.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7