CKFinder version 1.4.3 contains a Cross Site Scripting (XSS) vulnerability in its File Upload function. This flaw allows an attacker to upload a crafted SVG file that includes active content, potentially leading to script execution in the context of the affected application.