{"action":"Upgrade org.graylog2:graylog2-server to 6.2.0 or later.","affected":[{"fixed":"6.2.0","introduced":"0"}],"component":"org.graylog2:graylog2-server","cve_ids":[],"ecosystem":"Maven","exploited":false,"fixed_versions":["6.2.0"],"ghsa_id":"GHSA-q9q2-3ppx-mwqf","id":"tcs_01M5N996KPPR0DMZ8Y0SNV0KPS","modified_at":"2026-09-10T03:50:24.627549928Z","published_at":"2025-05-07T15:27:04Z","references":["https://osv.dev/vulnerability/GHSA-q9q2-3ppx-mwqf","https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-q9q2-3ppx-mwqf","https://github.com/Graylog2/graylog2-server"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-q9q2-3ppx-mwqf","url":"https://osv.dev/vulnerability/GHSA-q9q2-3ppx-mwqf"}],"summary":"Graylog Allows Stored Cross-Site Scripting via Files Plugin and API Browser"}