Description
b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name[] parameter to the /upload URI.
Remediation
References
https://github.com/b3log/symphony/issues/620
Related Vulnerabilities
CVE-2019-13234 Vulnerability in maven package org.opencms:opencms-core
CVE-2021-32822 Vulnerability in npm package hbs
CVE-2021-23436 Vulnerability in npm package immer
CVE-2022-29251 Vulnerability in maven package org.xwiki.platform:xwiki-platform-flamingo-theme-ui
CVE-2018-11697 Vulnerability in maven package org.webjars.npm:node-sass