[showdoc/showdoc] Cross-site Scripting in ShowDoc

ShowDoc is vulnerable to stored cross-site scripting due to unrestricted file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-0941
• https://github.com/star7th/showdoc/commit/4b6e6603c714aab1de346c5f5cb0bbb4c871be1f
• https://huntr.dev/bounties/040a910e-e689-4fcb-9e4f-95206515d1bc
• https://github.com/advisories/GHSA-wg4r-q74r-p7c8