CVE-2026-38948 is a Cross-Site Scripting (XSS) vulnerability in FUEL CMS v1.5.2 and earlier. It occurs because the asset upload feature fails to properly sanitize SVG files, enabling authenticated users with low privileges to upload malicious SVGs containing executable code. This vulnerability can be exploited to execute scripts in the context of the application, potentially impacting confidentiality and integrity. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and partial impact on confidentiality and integrity. No official fix or patch is currently documented.

Successful exploitation allows a low-privileged authenticated user to execute malicious scripts within the application context by uploading crafted SVG files. This can lead to partial compromise of confidentiality and integrity of the affected system. There is no indication of availability impact. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor SVG file uploads and consider disabling SVG uploads if possible. Apply strict input validation and sanitization on uploaded assets to mitigate the risk. Avoid granting unnecessary upload privileges to low-privileged users.