Owlfiles File Manager Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability has been identified in Owlfiles File Manager version 12.0.1. This issue allows attackers to inject malicious scripts via the path parameter in HTTP server endpoints. By crafting URLs that target the download and list endpoints, attackers can embed script tags that execute arbitrary JavaScript in the browsers of users who click on the links.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the Owlfiles File Manager HTTP server with the path parameter including a script tag. This can be done using the download or list endpoints. The injected script will be executed in the user's browser, demonstrating the cross-site scripting vulnerability.