FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)
概要
FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, Stored XSS is possible via share metadata fields (e.g., title, description) that are rendered into HTML for /public/share/ without context-aware escaping. The server uses text/template instead of html/template, allowing injected scripts to execute when victims visit the share URL. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com
- web github.com