PT-2026-5331 · Fluentcms · Fluentcms

Jarosław Wawiórko · Published 2026-01-29 · Updated 2026-03-03 · CVE-2025-15549

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FluentCMS version 2026

Description FluentCMS version 2026 has a stored cross-site scripting issue. Authenticated administrators can upload SVG files containing JavaScript through the File Management module. An attacker can upload a malicious SVG file, and when a user accesses the file’s URL, JavaScript will execute in their browser. The vulnerable module is the File Management module, and the attack vector involves uploading SVG files.

Recommendations Apply updates to address the issue in the File Management module. Restrict file uploads to trusted sources. Sanitize uploaded SVG files to remove any embedded JavaScript code.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-15549

Affected Products

Fluentcms

References · 7

• https://github.com/fluentcms/FluentCMS/issues/2404 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-15549 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15549 · Security Note
• https://twitter.com/CVEnew/status/2016970900369744270 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2017016731621900738 · Twitter Post
• https://t.me/cveNotify/154043 · Telegram Post
• https://vulncheck.com/advisories/fluentcms-stored-xss-via-svg-upload-in-file-management · Note