| Package | Affected versions | Patched versions |
|---|---|---|
| in2code/femanager | ≥ 6.0.0, < 6.3.1< 5.5.1 | 6.3.15.5.1 |
| femanager | ≥ 6.0.0, < 6.3.1< 5.5.1 | 6.3.15.5.1 |
The extension allows by default to upload SVG files when a logged in frontend user uploads a new profile image. This may lead to Cross-Site Scripting, when the uploaded SVG image is used as is on the website.
Note: If SVG uploads are required, it is recommended to use the TYPO3 extension svg_sanitizer (added to TYPO3 core since versions 9.5.28, 10.4.18 and 11.3.0) to prevent upload of malicious SVG files or to set up a strict Content Security Policy for the destination folder of uploaded images.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free