Description
A malicious SVG file upload could bypass sanitization, be stored, and execute attacker-controlled JavaScript (XSS) after a user downloads it and opens it.
You are affected if:
- You have a collection configured to upload and allow SVG files which can then be downloaded by users.
Recommendation
Update the payload package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0-canary.0, < 4.0.0-canary.34 < 3.90.0** Patched version(s): **4.0.0-canary.34 3.90.0**
References
Could your website be exposed too?
SmartScanner can check your website for Payload: Bypassed sanitization of user uploaded SVGs and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Payload: Uploaded XML files could execute same-origin JavaScript - CVE-2026-105868
- Payload: Token refresh and password reset responses may expose restricted user fields - CVE-2026-105853
- TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - CVE-2026-47760
- Payload: Password hashes use insufficient PBKDF2 iterations - CVE-2026-105804
You might also like:
See something that needs correcting? Let us knowUpdated October 07, 2026