CVE-2021-37794

2021-08-3118:15:08

Google

osv.dev

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.8%

JSON

A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger malicious OS commands on the server running the FileBrowser instance.

CPENameOperatorVersion
filebrowsereq1.5.1
filebrowsereq1.3.10
filebrowsereq1.3.12
filebrowsereq2.12.0
filebrowsereq1.3.5
filebrowsereq1.3.7
filebrowsereq1.4.3
filebrowsereq1.11.0
filebrowsereq2.5.0
filebrowsereq2.0.16

Name	Operator	Version
filebrowser	eq	1.5.1
filebrowser	eq	1.3.10
filebrowser	eq	1.3.12
filebrowser	eq	2.12.0
filebrowser	eq	1.3.5
filebrowser	eq	1.3.7
filebrowser	eq	1.4.3
filebrowser	eq	1.11.0
filebrowser	eq	2.5.0
filebrowser	eq	2.0.16