GHSA-8jjh-j3c2-cjcv
Dashboard / Vulnerabilities / GHSA-8jjh-j3c2-cjcv
Summary: Cross-site Scripting via uploaded assets
Details: ### Impact HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. ### Patches It has been patched on 3.4.15 and 4.36.0.
References: https://github.com/statamic/cms/security/advisories/GHSA-8jjh-j3c2-cjcv, https://nvd.nist.gov/vuln/detail/CVE-2023-48701, https://github.com/statamic/cms, https://github.com/statamic/cms/releases/tag/v3.4.15, https://github.com/statamic/cms/releases/tag/v4.36.0
Affected packages
Package
Name: statamic/cms
Purl: pkg:composer/statamic/cms
Affected ranges
Type: ECOSYSTEM
Events:
