An application has the following javascript code which is triggered whenever an user tries to upload a file.


then if the user uploads a file named <img src=x onerror=alert()> the javascript code is executed.

Does this qualify as a Low-severity DOM-XSS? I mean, usually I see DOM-XSS which exploit URL giving more strength to the attack. In this case I should trick a user to upload a file with a specific name, so it's like a self-xss. Also, I couldn't find a cve for this kind of DOM-XSS.

  • it's much easier to use devtools to run code client-side. I don't see how this could inadvertently jeopardize a real user in the real world. FWIF, you should use a.text(fileName) to avoid such XSS.
    – dandavis
    Jul 19 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.