Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jirafeau
Description
Jirafeau normally prevents browser preview for SVG files due to the possibility that manipulated SVG files could be exploited for cross site scripting. This was done by storing the MIME type of a file and preventing the browser preview for MIME type image/svg+xml. This issue was first reported in CVE-2022-30110. However, it was still possible to do a browser preview of a SVG file by sending a manipulated MIME type during the upload, where the case of any letter in image/svg+xml had been changed (like image/svg+XML). The check for image/svg+xml has been changed to be case insensitive.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Jirafeau project/Jirafeauv5Range: 4.5.0
Patches
Vulnerability mechanics
Root cause
"The MIME type check for SVG files was not case-insensitive, allowing bypass via manipulated casing."
Attack vector
An attacker could upload a manipulated SVG file by sending a modified MIME type in the HTTP request, such as 'image/svg+XML' instead of the expected 'image/svg+xml'. This bypasses the security check that normally prevents browser previews of SVG files due to Cross-Site Scripting (XSS) risks [ref_id=1]. The vulnerability was previously addressed in CVE-2022-30110 but re-emerged due to the case-sensitive nature of the check.
Affected code
The vulnerability exists in the `jirafeau_is_viewable` function, specifically in the condition that checks the MIME type of uploaded files. The original code used `strpos($mime, 'image/svg+xml') === false` to exclude SVG files from being viewable. The fix replaces this with `stripos($mime, 'image/svg+xml') === false` to perform a case-insensitive comparison [ref_id=1].
What the fix does
The patch modifies the function `jirafeau_is_viewable` to use `stripos` instead of `strpos` when checking the MIME type against 'image/svg+xml' [ref_id=1]. This change makes the comparison case-insensitive, ensuring that any variation in casing of the SVG MIME type will be correctly identified and blocked, thus preventing the preview of potentially malicious SVG files.
Preconditions
- inputThe user must be able to upload files to the Jirafeau instance.
Generated on Jun 8, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2News mentions
0No linked articles in our index yet.