GO-2026-4404 Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS) in github.com/stefanprodan/podinfo

Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting XSS in github.com/stefanprodan/podinfo...

CVE-2025-70849

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

GHSA-MW8W-Q3F7-2V85 Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS)

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS)

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

CVE-2025-70849

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

Exploit for CVE-2025-70849

CVE-2025-70849-Podinf...

📄 Podinfo 6.10.0 Cross Site Scripting

Podinfo versions 6.10.0 and below suffer from a cross site scripting vulnerability. CVE-2025-70849: Stored XSS in Podinfo Summary A security vulnerability CWE-79 was identified in Podinfo, a web application for demonstrating Kubernetes microservices. The /store feature allows unauthenticated user...

CVE-2025-70849

Summary (Podinfo CVE-2025-70849) Podinfo (

CVE-2025-70849

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

PT-2026-5988

Name of the Vulnerable Software and Affected Versions podinfo versions through 6.9.0 Description An issue exists in podinfo that allows unauthenticated attackers to upload arbitrary files through a crafted POST request to the /store endpoint. The application renders uploaded content without a...

EUVD-2025-206697

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

podinfo 安全漏洞

Podinfo is a Kubernetes microservice template developed by Stefan Prodan. Versions of Podinfo 6.9.0 and earlier contain security vulnerabilities. These vulnerabilities stem from unvalidated attackers being able to upload arbitrary files through specially crafted POST requests. Additionally, the...

CVE-2025-70849

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

CVE-2025-70849

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

PT-2026-6454

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

CVE-2025-70849

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler, timoni, gitlab-runner, calico, cloud-provider-azure, azurefile-csi, custom-pod-autoscaler, kubescape-operator, rancher-system-agent, kapp-controller, sbom-convert, undock, kubernetes-csi-external-attacher, clickhouse-operator,...

CVE-2025-61730 vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler, timoni, mountpoint-s3-csi-driver, kubeflow, newrelic-fluent-bit-output, hydra, rancher-system-upgrade-controller, gitlab-runner, sftpgo-plugin-pubsub, container-object-storage-interface, paranoia, lvm-driver, descheduler, gitness, calico,...

CVE-2025-68119 vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler, timoni, gitlab-runner, calico, cloud-provider-azure, azurefile-csi, custom-pod-autoscaler, kubescape-operator, rancher-system-agent, kapp-controller, sbom-convert, undock, kubernetes-csi-external-attacher, clickhouse-operator,...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler, timoni, mountpoint-s3-csi-driver, kubeflow, newrelic-fluent-bit-output, hydra, rancher-system-upgrade-controller, gitlab-runner, sftpgo-plugin-pubsub, container-object-storage-interface, paranoia, lvm-driver, descheduler, gitness, calico,...