Symfonia Ready_ Cross-Site Scripting Vulnerability in File Upload Functionality

A cross-site scripting (XSS) vulnerability has been identified in the file upload feature of Symfonia Ready_ versions 7.0.0.0 through 7.19.39.23. This vulnerability allows users to inject arbitrary JavaScript into filenames, which is then executed whenever someone interacts with the uploaded file. The injected script is stored on the server, creating a persistent XSS risk.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user interacting with the file.