CVE-2022-0941: 
PHP vulnerability analysis and mitigation

CVE-2022-0941 is a stored Cross-Site Scripting (XSS) vulnerability discovered in GitHub repository star7th/showdoc versions prior to v2.10.4. The vulnerability was identified and disclosed on March 13, 2022, affecting the file upload functionality in the application (CVE Mitre).

The vulnerability stems from an unrestricted file upload feature in the application that failed to properly validate certain file extensions. The issue was specifically related to the AttachmentModel.class.php file, where dangerous file extensions were not properly filtered. A fix was implemented by adding the '.xsl' extension to the list of dangerous file extensions that should be blocked (GitHub Commit).

The vulnerability could allow an attacker to perform stored XSS attacks by uploading malicious files with specific extensions. This could potentially lead to the execution of arbitrary JavaScript code in the context of other users' browsers who access the uploaded content (Huntr).

The vulnerability was fixed in version v2.10.4 of showdoc by adding additional file extension validation in the AttachmentModel.class.php file. Users are advised to upgrade to this version or later to protect against this vulnerability (GitHub Commit).