Description
crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.
Remediation
References
https://github.com/omphalos/crud-file-server/commit/4155bfe068bf211b49a0b3ffd06e78cbaf1b40fa
https://hackerone.com/reports/311101
Related Vulnerabilities
CVE-2022-36083 Vulnerability in npm package jose
CVE-2022-48285 Vulnerability in maven package org.webjars:jszip
CVE-2023-45827 Vulnerability in npm package @clickbar/dot-diver
CVE-2022-36899 Vulnerability in maven package com.compuware.jenkins:compuware-ispw-operations
CVE-2016-10726 Vulnerability in maven package org.dspace:dspace-xmlui