CVE-2022-21650

Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after...

CVE-2022-21650

CVE-2022-21650 describes a stored XSS in Convos, caused by filtering bypass for file uploads: an SVG file uploaded with an .html extension bypasses the upload filter, allowing stored XSS that triggers when a user views the file. The vulnerability affects the Convos web-based chat application and ...