Closed
Description
Describe the bug
Stored XSS exists in Blogifier 3.0 via filename parameter in '/api/storage/upload/PostImage'.
Steps to reproduce
- Login as admin.
- Click on 'New post'.
- Click on 'Insert Image' and insert the following payload
<img src=1 onerror=alert(1)>in filename field. - Click on Save, Publish and View the post.
Metadata
Assignees
Labels
No labels