CVE-2021-25278

Name of the Vulnerable Software and Affected Versions: FTAPI versions 4.0 through 4.10

Description: The issue allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor.

Recommendations: For FTAPI versions 4.0 through 4.10, consider disabling the Background Image upload feature in the Submit Box Template Editor until a patch is available. Restrict access to the Submit Box Template Editor to minimize the risk of exploitation. Avoid using SVG documents in the Background Image upload feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.