-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how inline file content was served. The original code (pre-fix) only set 'Content-Disposition: inline' but didn't enforce a safe Content-Type like 'text/plain'. This is evident from the fix in commit 31ad4e0 which added explicit Content-Type handling. The getHandler() function's logic for the 'inline' action branch lacked proper content type sanitization, enabling XSS when browsers interpreted uploaded files as HTML.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/dutchcoders/transfer.sh | go | <= 1.4.0 |
A Semantic Attack on Google Gemini - Read the Latest Research