CVE-2023-30177

Name of the Vulnerable Software and Affected Versions CraftCMS versions 3.7.59 through 3.7.67

Description The issue allows an attacker to inject javascript code into the Volume Name, potentially leading to Cross Site Scripting (XSS) attacks. This could enable attackers to execute malicious scripts on the affected system.

Recommendations For CraftCMS versions 3.7.59 through 3.7.67, update to version 3.7.68 or later to resolve the issue. As a temporary workaround, consider restricting access to the Volume Name field to minimize the risk of exploitation.