CVE-2024-23659: 
Linux Debian vulnerability analysis and mitigation

SPIP before versions 4.1.14 and 4.2.x before 4.2.8 contains a Cross-Site Scripting (XSS) vulnerability that can be exploited through the name of an uploaded file. The vulnerability specifically affects the javascript/bigup.js and javascript/bigup.utils.js components (Debian Security).

The vulnerability is related to insufficient sanitization of file names during the file upload process in the bigup component. The issue was discovered in the JavaScript files bigup.js and bigup.utils.js, which handle file upload functionality. The fix involved implementing proper escaping of file names to prevent XSS attacks (SPIP Blog).

If exploited, this vulnerability could allow attackers to execute malicious JavaScript code in the context of other users' browsers through specially crafted file names during the upload process (SPIP Blog).

The vulnerability has been patched in SPIP versions 4.1.14 and 4.2.8. Users are advised to upgrade to these versions or later to protect against this security issue. The fix includes improved sanitization of file names in the bigup component (SPIP Blog).

The SPIP development team acknowledged and thanked Daniel Barros for reporting the vulnerability. The fix was promptly released as part of maintenance and security updates for both affected versions (SPIP Blog).