PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-47955 Exploit Db CVE debrief

CVE-2021-47955 describes a cross-site scripting issue in CouchCMS 2.2.1 where an authenticated attacker can upload a malicious SVG file through the file upload workflow and have embedded JavaScript execute when the file is later accessed or previewed. The supplied CVSS data rates the issue as medium severity, with user interaction required and no direct confidentiality, integrity, or availability impact recorded in the vector. Use the CVE published and modified timestamps provided in the source data, 2026-05-16, as record timing context only.

Vendor
Exploit Db
Product
Unknown
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-16
Original CVE updated
2026-05-16
Advisory published
2026-05-16
Advisory updated
2026-05-16

Who should care

CouchCMS administrators, developers, and security teams responsible for instances that allow authenticated file uploads, especially where SVG content can be stored and later viewed in a browser.

Technical summary

The vulnerability is a CWE-79 cross-site scripting flaw in CouchCMS 2.2.1 tied to SVG uploads via browse.php. According to the supplied description, an authenticated attacker can upload an SVG containing script tags, and the script executes when the file is accessed or previewed. The NVD metadata also lists the weakness as CWE-79 and provides a CVSS v4.0 vector indicating network access, low attack complexity, required user interaction, and scope impacts limited to subsequent component effects.

Defensive priority

Medium. Address promptly if your deployment permits authenticated users to upload or preview SVG files, because the attack can lead to browser-side script execution in affected user sessions.

Recommended defensive actions

  • Review whether SVG uploads are necessary; disable them if they are not required.
  • Add server-side validation and sanitization for uploaded SVG content.
  • Serve user-uploaded files with safe content-disposition and appropriate MIME handling to reduce browser execution risk.
  • Restrict who can upload files and limit access to preview or browse functionality.
  • Check for vendor updates, mitigations, or hardening guidance for CouchCMS 2.2.1.
  • Audit access logs for suspicious SVG uploads and unexpected preview activity.

Evidence notes

The debrief is based only on the supplied CVE description and NVD metadata. The source corpus states that the issue affects CouchCMS 2.2.1, involves malicious SVG uploads through browse.php, and is classified as CWE-79. References supplied with the record include the CouchCMS repository, an Exploit-DB exploit page, and a VulnCheck advisory URL; these were used only as source references, not as a basis for adding unsupported details.

Official resources

Public record timing in the supplied data shows the CVE published and modified on 2026-05-16. The vulnerability description itself is taken from the supplied CVE/NVD content; no additional discovery or exploitation timeline is asserted here