Description
Versions of cloudcmd before 9.1.6 are vulnerable to cross-site scripting (XSS) when listing files in a directory. The attacker must control the name of a file for this vulnerability to be exploitable.
Recommendation
Update the cloudcmd package to the latest compatible version. Followings are version details:
- Affected version(s): < 9.1.6
- Patched version(s): 9.1.6
References
Could your website be exposed too?
SmartScanner can check your website for Cross-Site Scripting (XSS) in cloudcmd and gives you actionable findings to investigate.
Start a free scanRelated Issues
- TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - CVE-2024-29881
- Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability - CVE-2024-43407
- YUI Cross-site Scripting (XSS) vulnerability - yui - GHSA-x5hj-47vv-53p8 - CVE-2013-4940
- TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - CVE-2026-47760
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023