Description
A cross-site scripting (XSS) vulnerability in Ready_'s File Explorer upload functionality allows injection of arbitrary JavaScript code in filename. Injected content is stored on server and is executed every time a user interacts with the uploaded file.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Symfonia | Ready_ | 7.0.0.0 – ≤ 7.19.39.23, 8.0.0.0 – ≤ 8.0.2.3 | — |
References
- https://cert.pl/posts/2025/04/CVE-2025-1980 third-party-advisory
- https://cert.pl/en/posts/2025/04/CVE-2025-1980 third-party-advisory
- https://ready-os.com/pl/ product