Threats tagged 'ghsa-22mh-xrg3-844j'

Axeloz Filesharing versions prior to 2.14.3 have a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts via raw HTML or javascript: Markdown links in bundle descriptions. When recipients view the public bundle preview page, the injected script executes through Alpine x-html, enabling attackers to steal the owner's token from localStorage and perform owner-scoped actions on victim bundles.