Description
crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.
Remediation
References
https://github.com/omphalos/crud-file-server/commit/4155bfe068bf211b49a0b3ffd06e78cbaf1b40fa
https://hackerone.com/reports/311101
Related Vulnerabilities
CVE-2021-23899 Vulnerability in maven package com.mikesamuel:json-sanitizer
CVE-2021-27191 Vulnerability in npm package get-ip-range
CVE-2023-26920 Vulnerability in npm package fast-xml-parser
CVE-2014-0050 Vulnerability in maven package commons-fileupload:commons-fileupload
CVE-2023-26048 Vulnerability in maven package org.eclipse.jetty:jetty-server