CVE-2017-20158 — vova07 Yii2 FileAPI Widget UploadAction.php run cross site scripting

Back Back to CVE browser

MEDIUM

vova07 Yii2 FileAPI Widget UploadAction.php run cross site scripting

Published Dec 31, 2022

6.1

MEDIUM

CVSS 3.1

EPSS 0.55%

Description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8. It has been declared as problematic. Affected by this vulnerability is the function run of the file actions/UploadAction.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.1.9 is able to address this issue. The identifier of the patch is c00d1e4fc912257fca1fce66d7a163bdbb4c8222. It is recommended to upgrade the affected component. The identifier VDB-217141 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Affected products

Vendor Vova07 Product Yii2 FileAPI Widget Default
n/a
- Version
  0.1.0
  Status
  affected
  Constraints
  -
- Version
  0.1.1
  Status
  affected
  Constraints
  -
- Version
  0.1.2
  Status
  affected
  Constraints
  -
- Version
  0.1.3
  Status
  affected
  Constraints
  -
- Version
  0.1.4
  Status
  affected
  Constraints
  -
- Version
  0.1.5
  Status
  affected
  Constraints
  -
- Version
  0.1.6
  Status
  affected
  Constraints
  -
- Version
  0.1.7
  Status
  affected
  Constraints
  -
- Version
  0.1.8
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Vova07

Yii2 FileAPI Widget

n/a

Version	Status	Constraints
0.1.0	affected	-
0.1.1	affected	-
0.1.2	affected	-
0.1.3	affected	-
0.1.4	affected	-
0.1.5	affected	-
0.1.6	affected	-
0.1.7	affected	-
0.1.8	affected	-

Remediation

No remediation recorded yet.

Metrics

0.55% 0.00548

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00548

Score over time

2023–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.55% (0.00548)	43.84th	v5 (v2026.06.15)
Jun 15, 2026	0.54% (0.00544)	41.12th	v5 (v2026.06.15)
Mar 17, 2025	0.07% (0.00075)	20.04th	v4 (v2025.03.14)
Dec 12, 2024	0.09% (0.00086)	38.34th	v3 (v2023.03.01)
Jun 12, 2024	0.09% (0.00089)	38.01th	v3 (v2023.03.01)
Feb 2, 2024	0.08% (0.00080)	33.35th	v3 (v2023.03.01)
Jan 7, 2024	0.07% (0.00074)	30.70th	v3 (v2023.03.01)
Dec 1, 2023	0.06% (0.00060)	23.34th	v3 (v2023.03.01)
Mar 7, 2023	0.05% (0.00052)	18.25th	v3 (v2023.03.01)
Mar 6, 2023	1.02% (0.01018)	40.69th	v2 (v2022.01.01)
Feb 23, 2023	1.02% (0.01018)	40.58th	v2 (v2022.01.01)
Jan 10, 2023	4.13% (0.04134)	85.52th	v2 (v2022.01.01)
Jan 1, 2023	3.87% (0.03867)	85.02th	v2 (v2022.01.01)

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (6)

https://github.com/advisories/GHSA-j82x-fh8h-326g
Advisory
https://github.com/vova07/yii2-fileapi-widget/commit/c00d1e4fc912257fca1fce66d7a163bdbb4c8222
patch
https://github.com/vova07/yii2-fileapi-widget/releases/tag/0.1.9
patchRelease Notes
https://nvd.nist.gov/vuln/detail/CVE-2017-20158
https://vuldb.com/?ctiid.217141
signaturepermissions-requiredPermissions RequiredThird Party Advisory
https://vuldb.com/?id.217141
vdb-entrytechnical-descriptionPermissions RequiredThird Party Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-j82x-fh8h-326g		Advisory
https://github.com/vova07/yii2-fileapi-widget/commit/c00d1e4fc912257fca1fce66d7a163bdbb4c8222		patch
https://github.com/vova07/yii2-fileapi-widget/releases/tag/0.1.9		patchRelease Notes
https://nvd.nist.gov/vuln/detail/CVE-2017-20158
https://vuldb.com/?ctiid.217141		signaturepermissions-requiredPermissions RequiredThird Party Advisory
https://vuldb.com/?id.217141		vdb-entrytechnical-descriptionPermissions RequiredThird Party Advisory