CVE-2020-35305

MediumCVSS 6.1

Published: 15/07/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.61%

45th percentile - higher than 45% of all known CVEs

Summary

Cross Site Scripting (XSS) vulnerability in Gollum versions 5.0 through 5.1.2. The attack is possible via the filename parameter in the 'New Page' dialog.

Risk Assessment

The risk involves an attacker injecting malicious scripts, potentially leading to user session theft, account takeover, or displaying fake content.

Recommendation

Immediately update Gollum to version 5.1.3 or later, which includes a fix for the XSS vulnerability.

Original NVD description (English source)

Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.