CVE-2017-9516

Craft CMS XSS Vulnerability

5.4 MediumPublic exploitFix available

Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

2.80%Down 1.7 points since Apr 14, 2021

What each source reports

NVD Score used 5.4

Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.

Record: CVE-2017-9516
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.

Record: CVE-2017-9516
Updated: 2026-11-02

EUVDEUVD-2022-2840 No score

Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.

Record: EUVD-2022-2840
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6pvw-hh48-jx7p 5.4

Craft CMS XSS Vulnerability

Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.

Record: GHSA-6pvw-hh48-jx7p
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 5.4

Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.

Record: CVE-2017-9516
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-6pvw-hh48-jx7p 5.4

Craft CMS XSS Vulnerability

Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.

Record: GHSA-6pvw-hh48-jx7p
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

craftcms craft cms

Affected packages

Affected packages
Package	Affected	Fixed
`craftcms/cms` Packagist	before 2.6.2982	2.6.2982
`craftcms/cms` Packagist	before 2.6.2982, plus listed versions 1.0.26.11.2.0-alpha.23101.2.0-alpha.23121.2.0-alpha.23161.2.0-alpha.2318 Show 45 moreShow less 1.2.0-alpha.23191.2.0-alpha.23221.2.0-alpha.23231.2.0-alpha.23241.2.0-alpha.23281.2.0-alpha.23291.2.0-alpha.23321.2.23331.2.23351.2.23361.2.23371.2.23391.2.23581.2.23631.2.23671.2.23711.2.23751.2.23871.2.23921.2.23961.2.23991.3.0-alpha.23611.3.0-alpha.23661.3.0-alpha.23721.3.0-alpha.23741.3.0-alpha.23771.3.0-alpha.23781.3.0-alpha.23801.3.0-alpha.23881.3.0-alpha.23941.3.0-alpha.23971.3.0-alpha.24011.3.0-alpha.24021.3.0-alpha.24051.3.0-alpha.24641.3.24091.3.24101.3.24151.3.24161.3.24181.3.24191.3.24201.3.24221.3.24561.3.2459	2.6.2982

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Craft CMS 2.6 - Cross-Site Scripting	2017-06-08

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-9516 is a medium vulnerability (CVSS 5.4) in Craftcms Craft Cms, published June 8, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.80%, the 86th percentile. Fixed in craftcms/cms 2.6.2982.

References

This page doesn't list everything

Left out here: 234 versions. The JSON record has them.