Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog

MEDIUM 6.1CVE-2020-35305 · GHSA-fj2w-qmjp-3rjm · Published 15/07/2022 · updated 09/07/2026

In short

CVE-2020-35305 is a MEDIUM (CVSS 6.1) vulnerability affecting gollum, gollum (gollum project).
Chance of exploitation in the next 30 days (EPSS): 0.79%, higher than 56.5% of all vulnerabilities.
Fix: update to 5.1.2 or later.

Package	Affected versions	Patched versions
gollum RubyGems	`≥ 5.0, < 5.1.2`	`5.1.2`
gollum gollum_project	`≥ 5.0.0, ≤ 5.1.2`	No fix yet

Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.

NVD description

Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

RubyGems

≥ 5.0, < 5.1.2

5.1.2

≥ 5.0.0, ≤ 5.1.2

No fix yet

More vulnerabilities in gollum

See all →