showdoc .xxhtml file upload vulnerability

showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 contain a file upload vulnerability that stems from the lack of effective detection of .xxhtml file extensions in the application’s file upload feature. An attacker could exploit this vulnerability to upload malicious files and execute malicious scripts in the user’s ? browser to execute malicious scripts, steal user cookies, etc.