Threats affecting pkg:github/farisc0de/Uploady

CVE-2026-33653 is a stored cross-site scripting (XSS) vulnerability in the farisc0de Uploady file uploader script versions prior to 3.1.2. The vulnerability arises from improper sanitization of filenames during the file upload process, allowing an attacker to upload files with malicious JavaScript code embedded in the filename. This code executes in the browser of any user who views the affected file list or details page. The issue is fixed in version 3.1.2.