GitHub Security Lab (GHSL) Vulnerability Report, Alist

[Kwstubbs]

Please make sure of the following things

• I have read the documentation.
  我已经阅读了文档。

• I'm sure there are no duplicate issues or discussions.
  我确定没有重复的issue或讨论。

• I'm sure it's due to AList and not something else(such as Network ,Dependencies or Operational).
  我确定是AList的问题，而不是其他原因（例如网络，依赖或操作）。

• I'm sure this issue is not fixed in the latest version.
  我确定这个问题在最新版本中没有被修复。

AList Version / AList 版本

v3.28.0

Driver used / 使用的存储驱动

local

Describe the bug / 问题描述

Github Security Lab has submitted a vulnerability report at https://github.com/alist-org/alist/security/advisories/GHSA-6cg9-7cgv-727q. Please let us know if any the maintainers of Alist are able to see this report by replying in the advisory. We look forward to helping you fix this issue. Thank you.

Reproduction / 复现链接

Can be found in vulnerability report.

Config / 配置

Default

Logs / 日志

No response

[welcome]

Thanks for opening your first issue here! Be sure to follow the issue template!

[github-actions]

See

1. 54% Alist has Cross Site Scripting (XSS) vulnerability #645

[itsHenry35]

sorry that I misunderstood you, i think you should email or tag him if it's urgent

[Kwstubbs]

@xhofe has responded in the draft advisory