CVE-2023-26771

Taskcafe version 0.3.2 is vulnerable to Cross-Site Scripting (XSS) due to a lack of filetype validation during SVG profile picture uploads. An authenticated attacker can exploit this by uploading a malicious SVG file containing an XSS payload, which triggers when a victim opens the file. As a tem...