CVE-2018-25157
CVE-2018-25157 · Phraseanet 4.0.3 Stored XSS via Document Upload
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Phraseanet 4.0.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through crafted file names during document uploads. Attackers can upload files with embedded SVG scripts that execute in the browser, potentially stealing cookies or redirecting users when the file is viewed.
CVSS 5.1 · Medium · EPSS 0.3%
- Published
- Updated
Stack: php
Affected products and versions
phraseanet dam open source
- Versions
- <= 4.0.3: Affected
- 4.0.4-dev: Affected
No fix published
phraseanet/phraseanet Packagist
- Versions
- 4.0.3
No fix published