This vulnerability involves a stored XSS flaw in FluentCMS 1.2.3's File Management module. An authenticated administrator can upload SVG files with embedded JavaScript code. The malicious script is stored on the server and executed in the browsers of users who view the image via its direct URL. The vulnerability requires administrator authentication to upload the crafted SVG but affects any user who accesses the image URL, including unauthenticated visitors. No CVSS score or official remediation information is currently available.

Successful exploitation allows execution of arbitrary JavaScript in the browsers of users who access the malicious SVG image URL. This can lead to session hijacking, defacement, or other client-side attacks within the context of the vulnerable site. The vulnerability requires an authenticated administrator to upload the malicious file, which limits the initial attack vector to trusted users with elevated privileges. There is no indication of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and consider disabling SVG file uploads if possible. Monitor for suspicious SVG uploads and avoid sharing direct URLs to uploaded SVG images publicly.