medium5.4
CVE-2021-25975
Cross site scripting in publify
Impact
In publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS as a result of an unrestricted file upload. This issue allows a user with “publisher” role to inject malicious JavaScript via the uploaded html file.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | publify_core | >= 8.0, < 9.2.5 | 9.2.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Publify Project | Publify | from 8.0 through 9.2.4 |