Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2021-3741: Chatwoot Chat App Allows Malicious SVG Uploads, Risks User Security
CVE-2021-3741 · published 1 year ago
Summary
An attacker can upload a malicious SVG file to the Chatwoot chat app, which can cause security risks when the file is opened. This affects all versions of the app prior to 2.6. Update to version 2.6 or later to fix the issue.
What to do
- Update chatwoot chatwoot to version 2.6.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| chatwoot | chatwoot |
< 2.6.0 cpe:2.3:a:chatwoot:chatwoot:*:*:*:*:*:*:*:* |
Original advisory text
A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerability occurs when a user uploads an SVG file containing a mal...
A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerability occurs when a user uploads an SVG file containing a malicious XSS payload in the profile settings. When the avatar is opened in a new page, the custom JavaScript code is executed, leading to potential security risks.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published15 Nov 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2021-3741 · NVD
Track software like this
Free during beta