CVE-2023-26771
CVSS 3.1 Score 6.5 of 10 (medium)
Details
Published Oct 4, 2024
Updated: Oct 7, 2024
CWE ID 79
Summary
CVE-2023-26771 is a Cross-Site Scripting (XSS) vulnerability affecting Taskcafe version 0.3.2. The issue lies in the lack of validation for filetypes during SVG profile picture uploads. An attacker, once authenticated, can exploit this flaw by uploading a malicious SVG file containing an XSS payload. Upon opening the contaminated file, the victim is at risk of having their browser execute the attacker's malicious code.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.