GHSA-j2xf-p274-g8ccmedium6.1
Cross-site Scripting in Jirafeau
The advisory, in context
The file preview functionality in Jirafeau < 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/svg+xml files containing JavaScript. When someone visits the File Preview URL for this file, the JavaScript inside of this image/svg+xml file will be executed in the users' browser.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
mojo42/jirafeau Packagist
Ecosystem versions
Earlier releases before 4.4.0
Fixed in 4.4.0
1 explicitly affected versions
4.3.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.4.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.3.0"
]
}