GHSA-fg25-gq9g-32mx
Cross site scripting in Cloudreve
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/HFO4/cloudreve | >= 1.0.0, <= 2.0.0 | no fix listed |
| Go | github.com/cloudreve/Cloudreve/v3 | >= 3.0.0, < 3.6.0-beta1 | 3.6.0-beta1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functionality. A low privileged user will be able to share a file with an admin user, which could lead to privilege escalation.
References
External links from the advisory. They lead to third-party sites.