ozozuz/magnolia-cms-6.2.19-stored-cross-site-scripting-cve-2022-33098Proof-of-concept exploit for stored cross-site scripting (XSS) in Magnolia CMS 6.2.19 via crafted SVG upload, with detailed vulnerability analysis and remediation guidance.
Revision: 1.0
Impact: Stored cross-site scripting in Magnolia CMS 6.2.19 allows a remote attacker to execute arbitrary web scripts or HTML in a victim's browser by uploading a crafted SVG payload through the Edit Contact workflow or related asset handling functionality.
Severity:
CVSS Score:
CVE-ID: CVE-2022-33098
Vendor: Magnolia
Affected Products:
Affected Versions: 6.2.19 and earlier
Magnolia CMS is a content management platform used to build and manage digital experiences across web and related channels.
Magnolia CMS v6.2.19 contains a stored cross-site scripting issue in the contact editing and upload flow. A crafted SVG file can be uploaded as an asset or as a contact profile picture, and the embedded JavaScript executes when the payload is rendered back in the application.
The issue is particularly relevant because the payload is stored server-side and later served through a trusted application path, which makes the resulting script execution appear to originate from the target application itself.
Upload a malicious SVG through the Edit Contact workflow as either a profile picture or an asset.
Example payload:
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"></svg>
The upload is accepted, and the payload executes when the SVG is rendered in the contact or asset view.
Refer to Magnolia CMS 6.2.20 release notes and upgrade to a fixed version.
This vulnerability was discovered and reported by:
Copyright (c) 2025 Giulio Garzia "Ozozuz"