CVE-2022-33098: Magnolia CMS Edit Contact stored XSS via SVG profile picture

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityCVSS rates it medium (6.1) and it requires user interaction, but the high EPSS percentile and public advisory raise the practical urgency for exposed Magnolia instances.

What it is

Magnolia CMS 6.2.19 contains a cross-site scripting flaw in the Edit Contact function. An attacker can supply a crafted SVG document containing JavaScript as a profile picture, and the script executes when that content is rendered. Because the payload is stored in a profile field, it can fire for other users who view the affected contact.

Impact

An attacker can run arbitrary script or HTML in the browser context of a victim viewing the crafted profile picture, enabling session theft, credential capture or actions performed as the victim. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached over the network through the Edit Contact profile picture upload/rendering path. The vector requires user interaction (UI:R) and no privileges (PR:N), so a victim must view or interact with the crafted SVG content.

Exploitation

Not listed in CISA KEV and no ransomware association is documented. EPSS is high (0.52695, ~98.9th percentile), and a public Packet Storm advisory exists, indicating exploit interest, but the record does not confirm in-the-wild exploitation.

What to do

• Upgrade Magnolia CMS to 6.2.22 or later, which the vendor release notes cover.
• If immediate upgrade is not possible, restrict or disable SVG uploads for profile pictures and validate/sanitize uploaded image content.
• Serve user-uploaded images with a restrictive Content-Type and Content-Disposition, and from a separate origin, to limit script execution.
• Apply a Content Security Policy that blocks inline and untrusted script execution.
• Restrict who can edit contact profiles and review existing profile pictures for embedded script.

Detection

• Search Magnolia logs and upload records for SVG files or image uploads containing script tags, event handlers or javascript: URIs.
• Monitor for profile picture uploads with mismatched content types or SVG content where raster images are expected.
• Review web/proxy logs for requests to profile picture endpoints followed by script-like payloads or anomalous referrers.
• Alert on CSP violation reports or browser-side XSS indicators tied to contact profile pages.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.