← Vulnerability feed

Vulnerability record · CVE-2022-24749 · published 14 March 2022

CVE-2022-24749: Sylius unrestricted file upload vulnerability

Sylius · Sylius

Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting (XSS) code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the IMG tag. The problem applies both to the files opened on the admin panel and shop pages. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. As a workaround, require a library that adds on-upload file sanitization and overwrite the service before writing the file to the filesystem. The GitHub Security Advisory contains more specific information about the workaround.

6.1 CVSS 3.1 Medium EPSS 1.1% · top 35.5% CWE-80 · CWE-80CWE-434 · Unrestricted file upload
6.1CVSS 3.1 base score, v2 4.3
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting (XSS) code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the IMG tag. The problem applies both to the files opened on the admin panel and shop pages. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. As a workaround, require a library that adds on-upload file sanitization and overwrite the service before writing the file to the filesystem. The GitHub Security Advisory contains more specific information about the workaround.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/Sylius/Sylius/releases/tag/v1.10.11 Third Party Advisory
https://github.com/Sylius/Sylius/releases/tag/v1.11.2 Third Party Advisory
https://github.com/Sylius/Sylius/releases/tag/v1.9.10 Third Party Advisory
https://github.com/Sylius/Sylius/security/advisories/GHSA-4qrp-27r3-66fj ExploitThird Party Advisory
https://github.com/Sylius/Sylius/releases/tag/v1.10.11 Third Party Advisory
https://github.com/Sylius/Sylius/releases/tag/v1.11.2 Third Party Advisory
https://github.com/Sylius/Sylius/releases/tag/v1.9.10 Third Party Advisory
https://github.com/Sylius/Sylius/security/advisories/GHSA-4qrp-27r3-66fj ExploitThird Party Advisory

Track CVE-2022-24749 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.2CVE-2022-24743Sylius insufficient session expiration vulnerabilitySylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password wa…EPSS 1.3%7.5CVE-2024-57610Sylius improper restriction of authentication attempts vulnerabilityA rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasin…EPSS 1.2%7.1CVE-2026-31820Sylius insecure direct object reference vulnerabilitySylius is an Open Source eCommerce Framework on Symfony. An authenticated Insecure Direct Object Reference (IDOR) vulnerability exists in multiple sh…EPSS 0.34%6.9CVE-2026-31819Sylius open redirect vulnerabilitySylius is an Open Source eCommerce Framework on Symfony. CurrencySwitchController::switchAction(), ImpersonateUserController::impersonateAction() and…EPSS 0.30%6.9CVE-2026-31821Sylius missing authorization vulnerabilitySylius is an Open Source eCommerce Framework on Symfony. The POST /api/v2/shop/orders/{tokenValue}/items endpoint does not verify cart ownership. An …EPSS 0.30%6.4CVE-2024-29376Sylius cross-site scripting vulnerabilitySylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.EPSS 0.42%6.1CVE-2022-24733Sylius clickjacking vulnerabilitySylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to lo…EPSS 0.91%5.9CVE-2026-31824Sylius race condition vulnerabilitySylius is an Open Source eCommerce Framework on Symfony. A Time-of-Check To Time-of-Use (TOCTOU) race condition was discovered in the promotion usage…EPSS 0.30%

Source: NIST National Vulnerability Database (record CVE-2022-24749), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.