3 ms·
Check your contact area. I notified you of an XSS issue.
by beardog 10y ago
Check your contact area. I notified you of an XSS issue.
- silasb 10y agoCurious what it is. No CSRF token?
- NoFile 10y agoThanks for reporting the issue. The XSS was related to the filenames. Although most operating systems don't allow users to upload files containing greater-than/less-than symbols, it's possible to add them by tampering the requests and changing the filename. From there you could change the filename to "<script>alert("xss")</script>" and run an XSS. This has now been patched by encoding the characters. Once we're a bit more stable we'll be sure to release a bug bounty program.