CVE-2026-14856

MediumCVSS 6.3

Published: 27/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

32th percentile - higher than 32% of all known CVEs

Summary

A stored XSS vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0. Insufficient validation of SVG files allows an authenticated low-privilege user to upload a malicious SVG with JavaScript. When an administrator views the file, the code executes in their browser context.

Risk Assessment

Chaining with CSRF could allow an attacker to hijack the admin account by extracting the CSRF token and performing unauthorized actions, such as modifying credentials.

Recommendation

Upgrade TastyIgniter to the latest version with fixed SVG validation. Implement additional defenses like Content Security Policy (CSP).

Other vulnerabilities in TastyIgniter

CVE-2026-29001High
TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form to achieve arbitrary OS command execution as the PHP application process user.

Original NVD description (English source)

A stored Cross-Site Scripting (XSS) vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sanitization of SVG files. An authenticated user with low privileges can upload a malicious SVG file containing JavaScript code. When an administrator views that file, the code executes in the context of their browser. By chaining this vulnerability with a Cross-Site Request Forgery (CSRF) attack, an attacker can extract the administrator’s CSRF token and perform unauthorized actions—such as modifying credentials—thereby gaining full control of the administrative account.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS