Medium severity · published May 16, 2026
CVE-2021-47955
CouchCMS 2.2.1 Cross-Site Scripting via SVG File Upload
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
CouchCMS 2.2.1 contains a cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript by uploading malicious SVG files through the file upload functionality. Attackers can upload SVG files containing embedded script tags to the browse.php endpoint, which are then executed in users' browsers when the files are accessed or previewed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
CouchCMS · CouchCMS
2.2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-47955
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-47955
github.com
https://github.com/CouchCMS/CouchCMS
www.exploit-db.com
https://www.exploit-db.com/exploits/49636
www.vulncheck.com
https://www.vulncheck.com/advisories/couchcms-cross-site-scripting-via-svg-file-upload
More from CouchCMS
7.2
CVE-2026-29002
CouchCMS Privilege Escalation via f_k_levels_list Parameter
6.5
CVE-2025-67004
** Disputed ** An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via traversing directories back after back
6.1
CVE-2023-41609
An open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL
4.3
CVE-2021-47958
CouchCMS 2.2.1 Server-Side Request Forgery via SVG upload
3.7
CVE-2025-15005
CouchCMS reCAPTCHA config.example.php hard-coded key