CVE-2017-20158

The CVE-2017-20158 entry concerns vova07 Yii2 FileAPI Widget up to 0.1.8. The vulnerability affects the run() function in actions/UploadAction.php, where manipulation of the file parameter enables a Cross-Site Scripting (XSS) vulnerability. It can be exploited remotely. A fix is available in vers...