[showdoc/showdoc] Cross-site Scripting in ShowDoc

ShowDoc is vulnerable to stored cross-site scripting via viva cshtm file upload in in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-0946
• https://github.com/star7th/showdoc/commit/e5d575928b1371a7e07b09b6592822298335062a
• https://huntr.dev/bounties/1f8f0021-396e-428e-9748-dd4e359715e1
• https://github.com/advisories/GHSA-qq74-vgcf-54c3