GHSA-3jxh-789f-p7m6

Craft CMS Cross-site Scripting Vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-27902

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	craftcms/cms	< 3.6.0	3.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-27902 advisory
https://github.com/craftcms/cms/commit/8ee85a8f03c143fa2420e7d6f311d95cae3b19ce web
https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#360---2021-01-26 web
https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security-1 web