Code injection in plupload

HIGH 8.8CVE-2021-23562 · GHSA-rp2c-jrgp-cvr8 · Published 03/12/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
plupload tiny	`< 2.3.9`	`2.3.9`
plupload npm	`< 2.3.9`	`2.3.9`

Description

This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file.

NVD description

This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file.

References

nvd.nist.gov/vuln/detail/CVE-2021-23562 · ADVISORY
moxiecode/plupload commit d12175d · WEB
moxiecode/plupload · PACKAGE
moxiecode/plupload · WEB
snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2306665 · WEB
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2306663 · WEB
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMOXIECODE-2306664 · WEB
snyk.io/vuln/SNYK-JS-PLUPLOAD-1583909 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free