Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-93506

SveltyCMS File Upload Endpoint upload-media server-side request forgery

CVSS 4.0 5.3 MEDIUMCVSS 3.1 6.3 MEDIUMCVSS 3.0 6.3 MEDIUMCVSS 2.0 6.5 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-93506

Published

A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called 05b4f9efeb79e9d72a693232334d7529687f896f. It is best practice to apply a patch to resolve this issue.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-93506

Published

SveltyCMS

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "n/a",
                    "product": "SveltyCMS",
                    "versions": [
                        {
                            "version": "0.0.6",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:sveltycms:sveltycms:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "File Upload Endpoint"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON