CVE-2024-50344
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
30/10/2024
Last modified:
15/04/2026
Description
I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIME type. Unfortunately, this logic is broken, thus allowing unsafe files containing Javascript to be executed with the application context. An attacker can exploit this vulnerability by uploading a supplementary file that contains a malicious code or script. This code will then be executed when the file is loaded in the browser. The vulnerability was fixed in version 5.11.2.
Impact
Base Score 3.x
4.60
Severity 3.x
MEDIUM