Cross-site scripting in eZ Platform Kernel
Impact
In file upload it is possible by certain means to upload files like .html and .js. These may contain XSS exploits which will be run when links to them are accessed by victims.
Patches
The fix consists simply of adding common types of scriptable file types to the configuration of the already existing filetype blacklist feature. See "Patched versions". As such, this can also be done manually, without installing the patched versions. This may be relevant if you are currently running a considerably older version of the kernel package and don't want to upgrade it at this time. Please see the settting "ezsettings.default.io.file_storage.file_type_blacklist" at: https://github.com/ezsystems/ezplatform-kernel/blob/master/eZ/Bundle/EzPublishCoreBundle/Resources/config/default_settings.yml#L109
Important note
You should adapt this setting to your needs. Do not add file types to the blacklist that you actually need to be able to upload. For instance, if you need your editors to be able to upload SVG files, then don't blacklist that. Instead, you could e.g. use an approval workflow for such content.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | ezsystems/ezplatform-kernel | < 1.2.5.1, >= 1.3.0, < 1.3.1.1 | 1.2.5.1, 1.3.1.1 |
| Composer package | ezsystems/ezpublish-kernel | < 6.13.8.2, >= 7.0.0, < 7.5.15.2 | 6.13.8.2, 7.5.15.2 |
References
- https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-mrvj-7q4f-5p42
- https://nvd.nist.gov/vuln/detail/CVE-2021-46875
- https://github.com/ezsystems/ezpublish-kernel/commit/29fecd2afe86f763510f10c02f14962d028f311b
- https://github.com/ezsystems/ezpublish-kernel
- https://packagist.org/packages/ezsystems/ezplatform-kernel#v1.2.5.1
- https://packagist.org/packages/ezsystems/ezpublish-kernel#v7.5.15.2
- Weakness (CWE)
CWE-79- Platform
- Composer
- Package
ezsystems/ezplatform-kernel, ezsystems/ezpublish-kernel- Disclosed
- 19.03.2021
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-mrvj-7q4f-5p42 - CC BY 4.0
Vulnerability history: ezsystems/ezpublish-kernel
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 14
- First → latest
- 03.2021 05.2024
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 5
- High 5
- Medium 2
- Low 2
Disclosures per year
- 2021: 2
- 2022: 6
- 2023: 3
- 2024: 3
- 2025: 0
- 2026: 0
-
Cross-site scripting in eZ Platform Kernel this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.