GHSA-pwq7-f7f9-cm2jMediumCVSS 6.1

Dutchoders transfer.sh contains an XSS vulnerability via malicious file upload

Published
September 30, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-40931 →

📋 Description

dutchcoders Transfer.sh versions 1.4.0 and prior are vulnerable to Cross Site Scripting (XSS) via a malicious document uploaded in transfer.sh. There is a fix commit merged into main for this issue, but an updated version has not yet been released.

🎯 Affected products1

  • go/github.com/dutchcoders/transfer.sh:<= 1.4.0

🔗 References (4)