CVE-2025-70849

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy (CSP) or adequate Content-Type validation, leading to Stored Cross-Site Scripting (XSS).

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Références

advisory github.com
advisory nvd.nist.gov
web gist.github.com