CVE-2020-26286 Arbitary file upload
Unauthenticated attackers can upload arbitrary files, including executable scripts, to HedgeDoc, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-26286?
CVE-2020-26286 is a high-severity vulnerability in hedgedoc, published on 28 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an unauthenticated attacker can upload arbitrary files to the upload storage backend including HTML, JS and PHP files. The problem is patched in HedgeDoc 1.7.1. You should however verify that your uploaded file storage only contains files that are allowed, as uploaded files might still be served. As workaround it's possible to block the `/uploadimage` endpoint on your instance using your reverse proxy. And/or restrict MIME-types and file names served from your upload file storage.
Weakness: CWE-434
Which versions are affected by CVE-2020-26286?
It affects 1 product.
Products include Hedgedoc Hedgedoc.
How do I fix CVE-2020-26286?
No fix has been published for CVE-2020-26286 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-26286 being exploited?
There is no known exploitation of CVE-2020-26286 in the wild and no public exploit code.
Other vulnerabilities in hedgedoc
Sources
Also known as GHSA-wcr3-xhv7-8gxc.