CVE-2024-22075

Name of the Vulnerable Software and Affected Versions Firefly III versions prior to 6.1.1

Description The issue allows for HTML injection in webhooks. It is related to a Client-Side Path Traversal (CSPT) vulnerability, which can be used to control data that was assumed to be uncontrollable. This occurs when bypassing built-in sanitization.

Recommendations For versions prior to 6.1.1, update to version 6.1.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of webhooks until a patch is applied. Avoid using potentially vulnerable webhooks in the affected versions to minimize the risk of exploitation.