medium6.1
CVE-2025-63830
CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function.
Impact
CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function. An attacker can upload a crafted SVG containing active content.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cksource | Ckfinder | Version 1.4.3 |