CVE-2023-41048

2 advisories.

PyPI/plone-namedfile CVE-2023-41048: low 3.7, EPSS 0.57%

plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images

Action: Upgrade plone-namedfile to 5.6.1 or later.

pip install plone-namedfile==5.6.1

pip install plone-namedfile==6.0.3

pip install plone-namedfile==6.1.3

pip install plone-namedfile==6.2.1

Affected

introduced	fixed	last affected
0	5.6.1	-
6.0.0	6.0.3	-
6.1.0	6.1.3	-
6.2.0	6.2.1	-

Fixed versions

5.6.1

6.0.3

6.1.3

6.2.1

Sources

CVE-2023-41048 · published 2023-09-21T17:14:58Z · modified 2026-06-10T17:14:16.501751069Z · JSON

PyPI/plone-namedfile CVE-2023-41048: medium 5.4, EPSS 0.57%

plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross sit