CVE-2023-37658

MediumCVSS 5.4

Published: 11/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

Version 2.15.0 of fast-poster is vulnerable to Cross Site Scripting (XSS). The file upload check only verifies binary image data but does not strictly check the file suffix, leading to stored XSS.

Risk Assessment

An attacker could exploit this vulnerability to inject malicious scripts, potentially leading to user data theft or session hijacking.

Recommendation

It is recommended to implement strict file suffix verification during uploads and to update to the latest version of the software to minimize risk.

Original NVD description (English source)

fast-poster v2.15.0 is vulnerable to Cross Site Scripting (XSS). File upload check binary of img, but without strictly check file suffix at /server/fast.py -> ApiUploadHandler.post causes stored XSS