{"action":"Upgrade getkirby/cms to 3.5.4 or later.","affected":[{"fixed":"3.5.4","introduced":"0"}],"component":"getkirby/cms","cve_ids":["CVE-2021-29460"],"ecosystem":"Packagist","epss":0.03174,"exploited":false,"fixed_versions":["3.5.4"],"ghsa_id":"GHSA-qgp4-5qx6-548g","id":"tcs_01M5KF79Y3D5TR2BCTKHQD6S5X","modified_at":"2026-07-08T06:28:27.942376241Z","published_at":"2021-04-30T17:30:06Z","references":["https://osv.dev/vulnerability/GHSA-qgp4-5qx6-548g","https://github.com/getkirby/kirby/security/advisories/GHSA-qgp4-5qx6-548g","https://nvd.nist.gov/vuln/detail/CVE-2021-29460","https://github.com/getkirby/kirby/releases/tag/3.5.4","http://packetstormsecurity.com/files/162359/Kirby-CMS-3.5.3.1-Cross-Site-Scripting.html"],"severity":{"label":"high","score":7.6},"sources":[{"source":"osv","source_id":"GHSA-qgp4-5qx6-548g","url":"https://osv.dev/vulnerability/GHSA-qgp4-5qx6-548g"}],"summary":"Cross-site scripting (XSS) from unsanitized uploaded SVG files in Kirby"}