CWE-79 XSS vulnerability in framapic.org
Dear Team, I'm a security researcher and bug bounty hunter (https://twitter.com/secuninja, https://www.openbugbounty.org/researchers/SecuNinja/) and referring to Luc's email I'm creating a bug report here.
The file sharing service running at framapic.org is not properly or even not respecting the security risks resulting of XSS in uploaded filenames. So while uploading a image file called "><img src=y onerror=alert(1)>.jpg
the XSS code is executed the first time. Not sure right now if there is any RCE possibility resulting of this.
Furthermore, I can upload svg files containing JS code and misuse your service to distribute malware or act malicious to users receiving the linkt to a "evil" svg then. For example: https://framapic.org/qiDVczXcCDPB/HZ6qaGgwl9GB.svg in this SVG JavaScript code is embedded and will executed depending on the use or used browser.
Both should not happen. Correpsonding report on OBB (which is doublechecking the existance of the vuln) can be found https://www.openbugbounty.org/reports/554366/