Medium severity4.8OSV Advisory· Published Jan 29, 2026· Updated May 12, 2026

CVE-2025-15549

Description

FluentCMS 2026 contains a stored cross-site scripting vulnerability that allows authenticated administrators to upload SVG files with embedded JavaScript via the File Management module. Attackers can upload malicious SVG files that execute JavaScript in the browser of any user accessing the uploaded file URL.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Fluentcms/FluentcmsOSV3 versions
v0.0.2, v0.0.3, v0.0.4, …+ 2 more
- (no CPE)range: v0.0.2, v0.0.3, v0.0.4, …
- cpe:2.3:a:fluentcms:fluentcms:*:*:*:*:*:*:*:*range: <=0.0.5
- (no CPE)range: <= 2026

Patches

Vulnerability mechanics

References

github.com/fluentcms/FluentCMS/issues/2404nvdExploitVendor Advisory
www.vulncheck.com/advisories/fluentcms-stored-xss-via-svg-upload-in-file-managementnvdThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000