Chatwoot Vulnerability Could Lead to Security Risks

CVE-2021-3741

What is CVE-2021-3741?

A stored cross-site scripting vulnerability has been identified in Chatwoot applications prior to version 2.6. This issue arises when a user uploads an SVG file containing malicious JavaScript payloads in the profile settings. Upon accessing the avatar through a new page, the embedded JavaScript executes, potentially compromising user data and application integrity. Effective measures are essential to mitigate security risks associated with SVG file uploads.

References