Shaarli versions prior to 0.15.0 are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability due to insufficient sanitization of special characters in uploaded or embedded filenames. When a specially crafted filename containing characters such as <, >, ", or ' is rendered in the DOM. Although the vector is somewhat limited by context and browser behavior (hence considered low severity)
A file uploaded with the filename will trigger DOM XSS
<img src="x" onerror="alert(1);">
4rdr Reporter
Shaarli versions prior to 0.15.0 are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability due to insufficient sanitization of special characters in uploaded or embedded filenames. When a specially crafted filename containing characters such as <, >, ", or ' is rendered in the DOM. Although the vector is somewhat limited by context and browser behavior (hence considered low severity)
A file uploaded with the filename will trigger DOM XSS