Pandawiki
Monthly
PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting flaw in the unauthenticated /share/v1/common/file/upload endpoint, where an attacker can upload HTML content under an image extension. The stored payload executes when an administrator is lured to /static-file/<key>?a=.pdf, because the query string defeats nginx attachment handling and causes the HTML to render inline, enabling theft of the panda_wiki_token JWT and session takeover. Exploitation requires administrator interaction and a valid admin session; a public PoC reference exists but is not verified as working exploit code, and the provided data do not confirm active exploitation.
PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting flaw in the unauthenticated /share/v1/common/file/upload endpoint, where an attacker can upload HTML content under an image extension. The stored payload executes when an administrator is lured to /static-file/<key>?a=.pdf, because the query string defeats nginx attachment handling and causes the HTML to render inline, enabling theft of the panda_wiki_token JWT and session takeover. Exploitation requires administrator interaction and a valid admin session; a public PoC reference exists but is not verified as working exploit code, and the provided data do not confirm active exploitation.