GO-2026-6566 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header in github.com/fabiolb/fabio

Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers clientip/tls/requestid still strippable via the Connection header in github.com/fabiolb/fabio...

Cross-site Scripting (XSS)

github.com/fabiolb/fabio is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the value of path and val in admin/ui/manual.go are not sanitized and can be used to inject arbitary Javascript into a victim's browser...