Nextcloud · Report #894876
XSS through image upload of contacts using svg file
Validstatus
lowseverity
$100bounty
22upvotes
17 Dec 2020disclosed
How it was found
This is a bypass of report #808287
Upload the attached file for the image of a contact, right click "Open image in new tab" and you will see the xss.
Impact
The person viewing the image of a contact can be victim of XSS.