CVE-2021-25967: 
Python vulnerability analysis and mitigation

In CKAN versions 2.9.0 to 2.9.3, a stored XSS vulnerability was identified via SVG file upload of users' profile pictures. The vulnerability was discovered and recorded on January 22, 2021, allowing low-privileged application users to store malicious scripts in their profile pictures (Mend Database).

The vulnerability is classified as CWE-79 (Cross-site Scripting) with a CVSS v3.1 base score of 5.4. The attack vector is network-based with low attack complexity, requiring low privileges and user interaction. The scope is changed, with low impact on confidentiality and integrity, and no impact on availability (Mend Database).

When exploited, the vulnerability allows attackers to execute malicious scripts in victims' browsers when they open the compromised profile pictures. This can lead to unauthorized access to sensitive browser-based information and potential session hijacking (Mend Database).

The recommended mitigation strategies include implementing Content Security Policy (CSP) to disallow inline JavaScript or using the 'content-disposition: attachment' header to force file downloads. No official fix was provided by the maintainer (Mend Database).