KUNBUS PiCtory Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability has been identified in KUNBUS PiCtory versions 2.11.1 and earlier. This issue allows authenticated remote attackers to execute HTML scripts by crafting special filenames that are stored via API endpoints. The manipulated filenames are later sent to the client as part of a configuration file list, where the lack of proper escaping or sanitization enables the execution of the injected scripts.

Impact

Exploitation of this vulnerability allows for cross-site scripting attacks, where an attacker can inject and execute malicious scripts in the context of the user's browser.

Remediation

Users are advised to update the PiCtory package to version 2.12. The update can be downloaded from the KUNBUS package repository. For guidance on activating authentication, refer to the KUNBUS authentication activation guide.