~ / search / GHSA-v94v-pxqp-5qgj

GHSA-v94v-pxqp-5qgj

Cross-site Scripting in ShowDoc

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-0950

Packages

EcosystemPackageAffectedFixed in
Packagist showdoc/showdoc < 2.10.4 2.10.4

Details

As written in the advisory (Markdown source, shown as plain text).

The upload feature of ShowDoc prior to version 2.10.4 allows files with the extension `.*html`, which leads to stored cross-site scripting.

References

External links from the advisory. They lead to third-party sites.