Threats tagged 'ghsa-x8w9-4784-h853'

Dromara free-fs versions 2.0.1 through 2.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows registered users to upload HTML files that are served inline as text/html, enabling script execution in the context of the application. Attackers can exploit this by sending victims a crafted preview link, which can lead to exposure of the victim's files and account information via API calls.