CVE-2021-37794

MITTEL 5.4CVE-2021-37794 · Published 31/08/2021 · updated 17/06/2026

Kurz gesagt

CVE-2021-37794 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in filebrowser (filebrowser project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.78%, höher als bei 56.1% aller Schwachstellen.
Abhilfe: auf 2.16.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
filebrowser filebrowser_project	`< 2.16.0`	`2.16.0`

Description

A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger malicious OS commands on the server running the FileBrowser instance.

References

gist.github.com/omriinbar/1e28649f31d795b0e9b7698a9d255b5c · Third Party Advisory
filebrowser/filebrowser · Product
filebrowser/filebrowser commit 201329a · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free