High severity7.7OSV Advisory· Published Apr 2, 2024· Updated Apr 15, 2026

CVE-2024-30248

Description

Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin page. This vulnerability was patched in version 1.3.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
piccolo-adminPyPI	>= 1.2.0, < 1.3.2	1.3.2

Affected products

Piccolo ORM/Piccolo AdminOSV
Range: 0.1.1, 0.1.3, 0.1.4, …
ghsa-coords
pkg:pypi/piccolo-admin
Range: >= 1.2.0, < 1.3.2

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-pmww-v6c9-7p83ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-30248ghsaADVISORY
github.com/piccolo-orm/piccolo_admin/commit/c419575c2467959d906154084d305648eb2b8fafnvdWEB
github.com/piccolo-orm/piccolo_admin/security/advisories/GHSA-pmww-v6c9-7p83nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.501
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000