LOW

GHSA-83fp-hh9m-c2jq

Piranha has stored cross-site scripting (XSS) vulnerability

Details

A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name field.

Are you affected?

Enter the version of the package you're using.

Affected packages

NuGet/Piranha

Introduced in: 0

No fixed version published yet for Piranha (nuget). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-67291[ADVISORY]
https://github.com/PiranhaCMS/piranha.core[PACKAGE]
https://github.com/vuquyen03/CVE/tree/main/CVE-2025-67291[WEB]
http://piranha.com[WEB]