{"cve":"CVE-2024-29891","nvd":{"published":"2024-03-27T20:15:07.780","modified":"2026-06-17T07:23:18.880","status":"Analyzed","description":"ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML and pretend it is an image to gain access to the victim's account in certain scenarios. A possible victim would need to directly open the supposed image in the browser, where a session in ZITADEL needs to be active for this exploit to work. The exploit could only be reproduced if the victim was using Firefox. Chrome, Safari as well as Edge did not execute the code. This vulnerability is fixed in 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","score":8.7},"cwes":["CWE-79","CWE-434"],"references":["https://github.com/zitadel/zitadel/releases/tag/v2.42.17","https://github.com/zitadel/zitadel/releases/tag/v2.43.11","https://github.com/zitadel/zitadel/releases/tag/v2.44.7","https://github.com/zitadel/zitadel/releases/tag/v2.45.5","https://github.com/zitadel/zitadel/releases/tag/v2.46.5"],"products":["zitadel:zitadel"],"source":"nvd","synced_at":"2026-10-19T21:47:51.568503435+00:00"},"epss":{"cve":"CVE-2024-29891","score":0.0076,"percentile":0.55314,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hr5w-cwwq-2v4m","url":"https://osv.dev/vulnerability/GHSA-hr5w-cwwq-2v4m","summary":"ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass","modified":"2026-09-10T03:50:10.594180623Z","packages":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":["<2.42.17"],"fixed":["2.42.17"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.43.0 <2.43.11"],"fixed":["2.43.11"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.44.0 <2.44.7"],"fixed":["2.44.7"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.45.0 <2.45.5"],"fixed":["2.45.5"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.46.0 <2.46.5"],"fixed":["2.46.5"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.47.0 <2.47.8"],"fixed":["2.47.8"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.48.0 <2.48.3"],"fixed":["2.48.3"]}]},{"id":"GO-2024-2665","url":"https://osv.dev/vulnerability/GO-2024-2665","summary":"ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel","modified":"2024-07-09T19:33:56Z","packages":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}