vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2022-21650

Stored XSS via html file upload in convos

MEDIUM
5.4
CVSS Score
Published: January 4, 2022 at 08:40 PM UTC
Updated: June 17, 2026 at 04:26 AM UTC
2 products affected across 2 vendorsConvosConvos

Using convos by convos-chat?

Get instant alerts when new vulnerabilities affect convos - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.4
Exploit prediction
EPSS 0.8%
SSVC
PoC

Description

Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after uploading a file the XSS attack is triggered upon a user viewing the file. Through this vulnerability, an attacker is capable to execute malicious scripts. Users are advised to update as soon as possible.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Convos· Convos
95%
6.48 ≤ v < 6.52
Affected range stops below 6.52, so it looks safe — our inference, not a vendor statement
Convos· Convos Chat
60%
v < 6.52
Affected range stops below 6.52, so it looks safe — our inference, not a vendor statement

References (4)

x_refsource_MISCBroken Link
Source: [email protected]
https://blog.pocas.kr/2021/12/30/2021-12-30-s-xss-convos-chat/#First-vulnerability
x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/convos-chat/convos/commit/5c0a1ec9a2c147bc3b63fd5a48da5f32e18fe5df
x_refsource_CONFIRMPatchThird Party Advisory
Source: [email protected]
https://github.com/convos-chat/convos/security/advisories/GHSA-mm2v-4v7g-m695
x_refsource_MISCExploitIssue TrackingPatchThird Party Advisory
Source: [email protected]
https://www.huntr.dev/bounties/ae424798-de01-4972-b73b-2db674f82368/

SSVC — Action Prioritization

SSVCPoCNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.4MEDIUM[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card