CVE-2026-22257
Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names
概要
Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generates a file view of a folder without sanitizing the files or folders names, this may potentially lead to XSS in cases where a website allow the access to public files using this feature and anyone can upload a file. This issue has been patched in version 0.88.1.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com