Cross-site Request Forgery (CSRF)

Overview hfs is a HTTP File Server Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the apiMiddleware request filter in src/apiMiddleware.ts. An attacker can create accounts or change configuration by causing a logged-in administrator’s browser to send a...

Cross-site Scripting (XSS)

Overview hfs is a HTTP File Server Affected versions of this package are vulnerable to Cross-site Scripting XSS through the basicWeb file-listing renderer in src/basicWeb.ts. An attacker can execute script in a victim’s browser by uploading a file with a malicious name and getting someone to open...