GHSA-mw8w-q3f7-2v85

Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS)

Source: GitHub Advisory Database (reviewed) Low CVE-2025-70849

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/stefanprodan/podinfo	< 1.8.1-0.20260314125853-83deb7fcb742	1.8.1-0.20260314125853-83deb7fcb742

Details

As written in the advisory (Markdown source, shown as plain text).

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy (CSP) or adequate Content-Type validation, leading to Stored Cross-Site Scripting (XSS).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-70849 advisory
https://github.com/stefanprodan/podinfo/pull/463 web
https://github.com/stefanprodan/podinfo/commit/83deb7fcb7421f2d01eeb7475b18d72f16084aed web
https://gist.github.com/kazisabu/27f3e272f474005001a9ecd2c258dbea web
https://github.com/stefanprodan/podinfo package
https://github.com/stefanprodan/podinfo/releases/tag/6.11.1 web