-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key points: 1) The AllowedTypesSelect component explicitly allows 'files' category containing PDFs and other executable formats, as shown in its options array. 2) The MediaLibraryInput's validation logic (lines 33+) relies on these allowedTypes without proper content inspection. Together they enable uploading files with embedded JavaScript, which when accessed via direct URL triggers XSS. The GitHub advisory directly references these files, and their code aligns with the described vulnerability mechanics.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @strapi/strapi | npm | <= 4.1.12 |