Description
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| JiHong88 | suneditor | < 3.4.0 | 3.4.0 |
References
- GitHub Security Advisory (GHSA-2w4v-r3v4-f5h4) vendor-advisory
- VulnCheck Advisory: SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename third-party-advisory