FanFootage · Report #93807

XSS by image file name

Validstatus

7upvotes

9 Dec 2015disclosed

How it was found

Hello,

An XSS can be triggered if the user uploaded an image with an XSS vector as the file name, See the screenshot for more info,

Thanks

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original