Skip to content
OpenAdvisories
Medium · 6.1 CVE-2018-3726 EUVD-2018-0276GHSA-h24f-9mm4-w336

Cross-site Scripting (XSS) - Stored in crud-file-server

Published Jun 7, 2018 · Updated Sep 17, 2024 · Assigned by hackerone

Vendor: HackerOne Product: crud-file-server node module Package: crud-file-server Ecosystem: npm

Description

crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.

Affected products

VendorProductAffectedFixed
HackerOne crud-file-server node module Versions before 0.8.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm crud-file-server < 0.8.0 0.8.0 GHSA-h24f-9mm4-w336

References