ADVISORIES

• CVE-2021-25975 (NVD)
• GHSA-3h7v-wqw7-ff28
• Vendor Advisory

GEM

publify_core

SEVERITY

CVSS v3.x: 5.4 (Medium)

UNAFFECTED VERSIONS

• < 8.0

PATCHED VERSIONS

• >= 9.2.5

DESCRIPTION

In publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS as a result of an unrestricted file upload. This issue allows a user with ‘publisher’ role to inject malicious JavaScript via the uploaded html file.

RELATED

• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25974