GHSA-mw75-qvfr-hpmr

Cross-site Scripting in ShowDoc

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-0938

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	showdoc/showdoc	< 2.10.4	2.10.4

Details

As written in the advisory (Markdown source, shown as plain text).

ShowDoc is vulnerable to stored cross-site scripting through file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-0938 advisory
https://github.com/star7th/showdoc/commit/830c89a4c2c5fd0dd491422bf8e97b4eb5713f55 web
https://github.com/star7th/showdoc package
https://huntr.dev/bounties/3eb5a8f9-24e3-4eae-a212-070b2fbc237e web