Cross-site scripting in NukeViet - #VU139336
Published: July 24, 2026
Vulnerability identifier: #VU139336
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in the context of the CMS domain.
The vulnerability exists due to cross-site scripting in vendor/vinades/nukeviet/Files/Upload.php when processing uploaded SVG files that are later rendered inline in an article. A remote user can upload a crafted SVG file containing embedded script to execute arbitrary JavaScript in the context of the CMS domain.
User interaction is required when a victim views an article containing the uploaded SVG.
Affected software
NukeViet
Remediation
Install security update from vendor's website.
NukeViet - update to 4.5.09