[showdoc/showdoc] Cross-site Scripting in showdoc/showdoc

showdoc/showdoc allows .properties files to upload which lead to stored XSS in versions prior to 2.10.4. This allows attackers to execute malicious scripts in the user’s browser.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-0960
• https://github.com/star7th/showdoc/commit/92bc6a83a3a60e01a0d2effb98ab47d8d7eab28f
• https://huntr.dev/bounties/462cd8a7-b1a9-4e93-af71-b56ba1d7ad4e
• https://github.com/advisories/GHSA-rphc-h572-2x9f