Mahara Cross-Site Scripting Vulnerability in File Uploads

A cross-site scripting (XSS) vulnerability has been identified in Mahara versions prior to 22.10.6, 23.04.6, and 24.04.1. The issue arises in the file browser system, where a file containing JavaScript code in its name can be uploaded, leading to the execution of the embedded script.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, upload a file through the Mahara file browser system. Ensure that the file name includes JavaScript code. Once the file is uploaded, the JavaScript will be executed, demonstrating the cross-site scripting vulnerability.

Remediation

Users are advised to update to Mahara versions 24.04.1, 23.04.6, or 22.10.6. These updates are available to subscribers via the Mahara code repository.