Description
A vulnerability in the file upload functionality of the FlatPress CMS admin panel (version latest) allows an attacker to upload a file with a JavaScript payload disguised as a filename. This can lead to a Cross-Site Scripting (XSS) attack if the uploaded file is accessed by other users. The issue is fixed in version 1.4.dev.
References (2)
Core 2
Core References
Third Party Advisory
https://huntr.com/bounties/a993a05f-be50-4983-a44a-3bbff1ec00db
Scores
CVSS v3
5.4
EPSS
0.0019
EPSS Percentile
40.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-79
Status
published
Products (1)
flatpress/flatpress
< 1.4
Published
Mar 20, 2025
Tracked Since
Feb 18, 2026