Listen to this Post
How the CVE Works
The vulnerability arises due to improper sanitization of HTML/JavaScript within Markdown files in File Browser v2.32.0. When a user uploads a malicious `.md` file containing embedded JavaScript (e.g., <img src="x" onerror=alert(1)>), the preview function renders and executes the script. This occurs because the Markdown parser fails to strip or sanitize HTML events, leading to stored XSS. Attackers can exploit this to hijack sessions, escalate privileges, or perform actions on behalf of the victim.
DailyCVE Form
Platform: File Browser
Version: 2.32.0
Vulnerability: Stored XSS
Severity: Critical
Date: 2025-06-26
Prediction: Patch expected by 2025-06-30
What Undercode Say
Check vulnerable version filebrowser --version | grep "2.32.0" PoC Markdown payload echo '<img src="x" onerror=alert(document.cookie)>' > exploit.md
How Exploit
1. Upload `exploit.md` to File Browser.
2. Victim previews the file.
3. Malicious script executes in victim’s context.
Protection from this CVE
- Update to v2.33.7+.
- Enable CSP headers.
- Sanitize Markdown with DOMPurify.
Impact
- Session hijacking.
- Privilege escalation.
- Remote code execution.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
