---
id: CVE-2025-14202
title: >-
  A vulnerability in the file upload at bookmark + asset rendering pipeline
  allows an attacker to upload a malicious SVG file with JavaScript content
summary: >-
  A vulnerability in the file upload at bookmark + asset rendering pipeline
  allows an attacker to upload a malicious SVG file with JavaScript content.
  When an authenticated admin user views the SVG file with embedded JavaScript
  code of sha…
severity: none
cwe:
  - CWE-79
published: '2025-12-18'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T11:10:00.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14202'
references:
  - url: 'https://www.cve.org/cverecord?id=CVE-2025-14202'
    label: b7efe717-a805-47cf-8e9a-921fca0ce0ce
tags:
  - nvd
epss: 0.0028
epssPercentile: 0.20393
ingestedAt: '2026-10-13T11:23:51.131Z'
---

## Overview

A vulnerability in the file upload at bookmark + asset rendering pipeline allows an attacker to upload a malicious SVG file with JavaScript content. When an authenticated admin user views the SVG file with embedded JavaScript code of shared bookmark, JavaScript executes in the admin’s browser, retrieves the CSRF token, and sends a request to change the admin's password resulting in a full account takeover.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.