| शीर्षक | https://github.com/openakita/openakita OpenAkita 1.27.12 Storage-type XSS |
|---|
| विवरण | In OpenAkita, the upload endpoint only blocks a small set of "executable program" file extensions. There is no whitelist-based MIME restriction. Uploaded files have their media_type inferred from the file extension and are served directly via FileResponse without forcing an attachment download. As a result, attackers can upload script-capable content such as SVG or HTML files. When the returned URL is opened directly in a browser, the script executes within the OpenAkita same-origin context. |
|---|
| स्रोत | ⚠️ https://app.notion.com/p/OpenAkita-Storage-type-XSS-36b6b282520c80e790d4d95013f67e31?v=399f40ee1bc649168d81ef87a0f77f31&source=copy_link |
|---|
| उपयोगकर्ता | NanHang (UID 97876) |
|---|
| सबमिशन | 10/06/2026 07:18 PM (2 महीनों पहले) |
|---|
| संयम | 03/08/2026 05:41 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 385609 [OpenAkita तक 1.27.12 File Upload API /api/upload Arquivo क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|