GHSA-pcxq-28f6-m3fmMediumCVSS 5.4

Firefly III vulnerable to image-based stored XSS

Published
May 24, 2022
Last Modified
July 5, 2023

🔗 CVE IDs covered (1)

CVE-2019-13647 →

📋 Description

Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$file_id$ attachment viewing.

🎯 Affected products1

  • composer/grumpydictator/firefly-iii:< 4.7.17.3

🔗 References (5)