An application has the following javascript code which is triggered whenever an user tries to upload a file.


then if the user uploads a file named <img src=x onerror=alert()> the javascript code is executed.

Does this qualify as a Low-severity DOM-XSS? I mean, usually I see DOM-XSS which exploit URL giving more strength to the attack. In this case I should trick a user to upload a file with a specific name, so it's like a self-xss. Also, I couldn't find a cve for this kind of DOM-XSS.

  • it's much easier to use devtools to run code client-side. I don't see how this could inadvertently jeopardize a real user in the real world. FWIF, you should use a.text(fileName) to avoid such XSS.
    – dandavis
    Commented Jul 19, 2021 at 20:08

1 Answer 1


In my opinion, yes, this is a low to very low severity example of XSS. User-controlled input is rendered insecurely.

The fact that this requires a user to upload a specially crafted file, reduces the likelihood of abuse, not the impact.

People are the weakest link in cybersecurity. They can be tricked into uploading any file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .