CVE-2020-29071
An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. The issue arises from the insecure rendering of HTML files uploaded to the platform as attachments, when the -htmlview URL is directly accessed. The impact ranges from executing commands as root on the server to retrieving sensitive information about encrypted e-mails, depending on the permissions of the target user.
- Affected products
- Liquidfiles
- Liquidfiles
- < 3.3.19
- Fix
- Available
- CVSS 3.1
- 9.0 CRITICAL
- EPSS
- 1.6% (74th percentile)
- Weakness
- CWE-79
- NVD status
- Modified
- Published
- 2020-11-25
CVE-2020-29071 at NVD
No indexed exploits for CVE-2020-29071 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2020-29071 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.