[showdoc/showdoc] Stored Cross-site Scripting in showdoc

ShowDoc is a tool for an IT team to share documents online. showdoc contains a stored cross-site scripting vulnerability in the File Library page when uploading a file in .ofd format in versions prior to 2.10.4. At this time, there is no known workaround. Users should update to version 2.10.4.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-0967
• https://github.com/star7th/showdoc/commit/3caa32334db0c277b84e993eaca2036f5d1dbef8
• https://huntr.dev/bounties/9dea3c98-7609-480d-902d-149067bd1e2a
• https://github.com/advisories/GHSA-3pg8-c473-w6rr