CVE-2025-70849

Go/github.com/stefanprodan/podinfo CVE-2025-70849: medium 6.1

Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS)

Action: Upgrade github.com/stefanprodan/podinfo to 1.8.1-0.20260314125853-83deb7fcb742 or later.

go get github.com/stefanprodan/podinfo@v1.8.1-0.20260314125853-83deb7fcb742

Affected

Fixed versions

Sources

• osv: GHSA-mw8w-q3f7-2v85
• https://nvd.nist.gov/vuln/detail/CVE-2025-70849
• https://github.com/stefanprodan/podinfo/pull/463
• https://github.com/stefanprodan/podinfo/commit/83deb7fcb7421f2d01eeb7475b18d72f16084aed
• https://gist.github.com/kazisabu/27f3e272f474005001a9ecd2c258dbea
• https://github.com/stefanprodan/podinfo
• https://github.com/stefanprodan/podinfo/releases/tag/6.11.1

CVE-2025-70849 · published 2026-02-03T18:30:47Z · modified 2026-03-16T12:33:28.195174Z · JSON

Go/github.com/stefanprodan/podinfo CVE-2025-70849: unknown

Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS) in github.com/stefanprodan/podinfo

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-4404
• https://github.com/advisories/GHSA-mw8w-q3f7-2v85
• https://nvd.nist.gov/vuln/detail/CVE-2025-70849
• https://gist.github.com/kazisabu/27f3e272f474005001a9ecd2c258dbea

CVE-2025-70849 · published 2026-02-05T03:20:45Z · modified 2026-02-05T10:11:14.469127Z · JSON