~ / search / GHSA-68q3-7wjp-7q3j

GHSA-68q3-7wjp-7q3j

The filename of uploaded files vulnerable to stored XSS

Source: GitHub Advisory Database (reviewed) High CVE-2020-4041

Packages

EcosystemPackageAffectedFixed in
Packagist bolt/bolt < 3.7.1 3.7.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented. ### Patches This is fixed in Bolt 3.7.1. ### References Related issue: https://github.com/bolt/bolt/pull/7853

References

External links from the advisory. They lead to third-party sites.