6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-70849

CVE-2025-70849: Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS)

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy (CSP) or adequate Content-Type validation, leading to Stored Cross-Site Scripting (XSS).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-70849

CVE-2025-70849:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/stefanprodan/podinfo	go	<= 1.8.1-0.20250515093358-fb3b01be30a3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) attack made possible by an arbitrary file upload flaw in the /store endpoint of the podinfo application. The analysis of the source code in pkg/api/http/store.go confirms the description in the advisory. The Server.storeWriteHandler function allows any unauthenticated user to POST data, which is then saved directly to a file without any content validation. Subsequently, the Server.storeReadHandler function serves this file to users who request it. The critical security failure is that the response from storeReadHandler lacks a Content-Type header that would instruct the browser to treat the file as plain text. Without this, browsers will attempt to render the content, executing any HTML or JavaScript it contains. This allows an attacker to upload a malicious script and have it execute in the browser of any user who views the file, leading to session hijacking, phishing, or other client-side attacks.

Vulnerable functions

Server.storeWriteHandler

pkg/api/http/store.go

This function handles the POST request to the `/store` endpoint. It reads the raw request body and writes it to a file on the server's filesystem without any validation or sanitization of the content. This allows an attacker to upload arbitrary files, including malicious HTML and JavaScript, which is the first step in the exploit chain.

Server.storeReadHandler

pkg/api/http/store.go

This function handles GET requests to `/store/{hash}` to retrieve a previously uploaded file. It writes the file's content directly to the HTTP response without setting a proper `Content-Type` header (e.g., `text/plain`). This causes web browsers to perform content sniffing and render the content as HTML if it looks like an HTML document. An attacker can abuse this behavior by crafting a malicious HTML file, uploading it via `storeWriteHandler`, and then tricking a victim into visiting the URL, leading to stored Cross-Site Scripting (XSS).

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.