In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented. This is fixed in Bolt 3.7.1.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| bolt/bolt(Packagist) | 0 | 3.7.1 | N/A |
CVSS Metrics
