CVE-2022-24749 Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius
Attackers can upload malicious SVG files to trigger XSS in Sylius admin and shop pages, potentially executing scripts in victim browsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-24749?
CVE-2022-24749 is a medium-severity cross-site scripting vulnerability in Sylius, published on 14 Mar 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting (XSS) code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the IMG tag. The problem applies both to the files opened on the admin panel and shop pages. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. As a workaround, require a library that adds on-upload file sanitization and overwrite the service before writing the file to the filesystem. The GitHub Security Advisory contains more specific information about the workaround.
Which versions are affected by CVE-2022-24749?
6 open source packages ship an affected version, including sylius/sylius. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sylius/sylius Packagist | All versions | 1.9.10 |
sylius/sylius Packagist | All versions | 1.9.10 |
sylius/sylius Packagist | From 1.10.0 | 1.10.11 |
sylius/sylius Packagist | From 1.10.0 | 1.10.11 |
sylius/sylius Packagist | From 1.11.0 | 1.11.2 |
sylius/sylius Packagist | From 1.11.0 | 1.11.2 |
Products include Sylius Sylius.
How do I fix CVE-2022-24749?
Upgrade sylius/sylius to a fixed version for your release line: 1.9.10, 1.10.11 or 1.11.2.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-24749 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24749 exists.
Other vulnerabilities in Sylius
- CVE-2026-31824 Sylius has a Promotion Usage Limit Bypass via Race Condition
- CVE-2024-57610 Denial of service in n/a
- CVE-2026-31820 Sylius affected by IDOR in Cart and Checkout LiveComponents
- CVE-2022-24743 Insufficient Session Expiration in Sylius
- CVE-2026-31819 Sylius has an Open Redirect via Referer Header
Sources
Also known as GHSA-4qrp-27r3-66fj.