GCVE - cpe:2.3:a:chevereto:chevereto:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:chevereto:chevereto:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Chevereto (`13859164-4b50-5cd3-957f-7cfd6b8fd349`)
Product	Chevereto (`612e599a-afa8-548c-a077-a9b5723343bd`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/rodber/chevereto-free`	purl2cpe	2026-06-01 10:16:09.766964

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-55417`	vulnerable	2026-07-29 01:00:28.452144	Chevereto private profile setting leaks username on /json endpoint Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route (`/username`) correctly returns 404. However, the `/json` AJAX listing endpoint does not apply the same check. An unauthenticated caller who knows the target's user ID can retrieve all of that user's publicly-scoped images, revealing the username (which should be private). This is patched in Chevereto v4.5.4. No known workarounds are available. Published: 2026-07-07T20:02:54.306Z Updated: 2026-07-08T13:11:19.485Z Open on db.gcve.eu Reference links https://github.com/chevereto/chevereto/security/advisories/GHSA-h4jp-mxfx-g8xp https://chevereto.com/community/threads/chevereto-v4-5-4-announcement.16398/post-80153	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-31721`	vulnerable	2026-06-08 05:31:53.857308	Details available Chevereto before 3.17.1 allows Cross Site Scripting (XSS) via an image title at the image upload stage. Published: 2021-06-30T10:55:15.000Z Updated: 2026-07-09T00:13:32.826Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/49859 http://packetstormsecurity.com/files/164183/Cloudron-6.2-Cross-Site-Scripting.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-1000058`	vulnerable	2026-06-08 05:08:33.733002	Details available Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user profile and one in the Exif data parser. Published: 2017-07-13T20:00:00.000Z Updated: 2024-08-05T21:53:06.317Z Open on db.gcve.eu Reference links https://chevereto.com/changelog	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.