Uploading SVG, WEBP and ICO files

Uploading SVG, WEBP and ICO files has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2023; 2 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2022 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type.

2 of the records (67%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2023.

2 independent researchers contributed these findings, most of them (2) reported by Universe.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage67%

Open

Fixed

Get automatic notifications for all Uploading SVG, WEBP and ICO files vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2023-4460

Uploading SVG, WEBP and ICO files <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG

Read the full analysis

Vulnerability Records

3 records


2023-11-13 00:00	Uploading SVG, WEBP and ICO files <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploading SVG, WEBP and ICO files <= 1.2.1	`CVE-2023-4460`	6.4 Medium	Danilo Albuquerque	No
2022-08-12 00:00	Uploading SVG, WEBP and ICO files <= 1.0.1 - Arbitrary File Upload Uploading SVG, WEBP and ICO files <= 1.0.1	`CVE-2022-36285`	7.2 High	Universe	Yes
2022-08-12 00:00	Uploading SVG, WEBP and ICO files <= 1.0.1 - Authenticated Stored Cross-Site Scripting Uploading SVG, WEBP and ICO files <= 1.0.1	`CVE-2022-34648`	5.5 Medium	Universe	Yes

Showing 1–3 of 3 reports