p PatchFirst

CVE-2024-30248

CVE-2024-30248 · Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin page. This vulnerability was patched in version 1.3.2.

CVSS 7.7 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • piccolo_admin

    Versions
    • >= 1.2.0, < 1.3.2: Affected

    No fix published

  • piccolo-admin PyPI

    Versions
    • 1.2.0
    • 1.2.1
    • 1.2.2
    • 1.3.0
    • 1.3.1
    Affected ranges
    • ECOSYSTEM: ≥ 1.2.0, < 1.3.2

    Update to 1.3.2

Original sources

Check your server →