Moonshine Arbitrary File Upload Vulnerability Allowing Code Execution

A vulnerability allowing arbitrary file upload has been identified in Moonshine version 3.12.4. This issue enables attackers to upload a malicious SVG file, which can execute arbitrary JavaScript code in the browser of a user who opens the file link.

Impact

Exploitation of this vulnerability allows for arbitrary code execution in the form of JavaScript execution within the context of the user's browser.

Reproduction

To reproduce this vulnerability, create or update an article in Moonshine version 3.12.4. In the 'Files' section, upload a crafted SVG file that includes a JavaScript payload, such as an alert script. Once the article is saved, the uploaded SVG can be accessed through the article link, triggering the JavaScript execution.