XSS vulnerabilities reported 12/2024

[gh-at-sqh]

According to GitHub advisory, Piranha CMS(<= 11.1.0) suffers from two XSS vulnerabilities of moderate severity (but not GitHub reviewed).

Notices below are both dated 12/20/2024 and were published in the National Vulnerability Database.

GHSA-cmwp-442x-3rcv
GHSA-mmx8-vrfg-hfmq

Have they been verified and addressed or are there plans and resources to do so?

Thanks!

[tidyui]

We're currently investigating one of them in the issue #2105. Please note that this does not affect Piranha CMS as a whole, it only applies if you use the Markdown editor.

The PDF-related issue has not started investigation, however this does not affect Piranha CMS as a whole either. It is completely configurable what file types you want to support in your application, and if you don't want to include the option to upload PDF-files this can be configured, see https://piranhacms.org/docs/master/content/media for more information.