Codiad Cross-site Scripting Vulnerability

MEDIUM 6.1CVE-2020-14042 · GHSA-g2x4-256v-5pvx · Published 25/08/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
codiad/codiad Packagist	`≥ 1.7.8, ≤ 2.8.4`	No fix yet
codiad codiad	`≥ 1.7.8`	No fix yet

Description

A Cross Site Scripting (XSS) vulnerability was found in Codiad v1.7.8 and later. The vulnerability occurs because of improper sanitization of the folder's name $path variable in components/filemanager/class.filemanager.php. NOTE: the vendor states "Codiad is no longer under active maintenance by core contributors."

NVD description

** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Site Scripting (XSS) vulnerability was found in Codiad v1.7.8 and later. The vulnerability occurs because of improper sanitization of the folder's name $path variable in components/filemanager/class.filemanager.php. NOTE: the vendor states "Codiad is no longer under active maintenance by core contributors."

References

nvd.nist.gov/vuln/detail/CVE-2020-14042 · ADVISORY
Codiad/Codiad · WEB
Codiad/Codiad · WEB
Codiad/Codiad · PACKAGE
web.archive.org/web/20220828225621/https://advisory.checkmarx.net/advisory/CX-2020-4278 · WEB
advisory.checkmarx.net/advisory/CX-2020-4278 · Exploit
Codiad/Codiad · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free