diff --git a/advisories/github-reviewed/2026/02/GHSA-mw8w-q3f7-2v85/GHSA-mw8w-q3f7-2v85.json b/advisories/github-reviewed/2026/02/GHSA-mw8w-q3f7-2v85/GHSA-mw8w-q3f7-2v85.json index 24c7be8ed124e..3bb2fe1f91333 100644 --- a/advisories/github-reviewed/2026/02/GHSA-mw8w-q3f7-2v85/GHSA-mw8w-q3f7-2v85.json +++ b/advisories/github-reviewed/2026/02/GHSA-mw8w-q3f7-2v85/GHSA-mw8w-q3f7-2v85.json @@ -1,23 +1,14 @@ { "schema_version": "1.4.0", "id": "GHSA-mw8w-q3f7-2v85", - "modified": "2026-02-05T15:41:47Z", + "modified": "2026-02-05T15:41:48Z", "published": "2026-02-03T18:30:47Z", "aliases": [ "CVE-2025-70849" ], "summary": "Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS)", "details": "Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy (CSP) or adequate Content-Type validation, leading to Stored Cross-Site Scripting (XSS).", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" - }, - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P" - } - ], + "severity": [], "affected": [ { "package": { @@ -32,11 +23,14 @@ "introduced": "0" }, { - "last_affected": "1.8.1-0.20250515093358-fb3b01be30a3" + "fixed": "6.11.1" } ] } - ] + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.8.1-0.20250515093358-fb3b01be30a3" + } } ], "references": [