CVE-2022-50891
Owlfiles File Manager 12.0.1 Cross-Site Scripting via HTTP Server
- State
- Published
- Severity
- 5.1 Medium
- Published
- Jan 13, 2026
- Updated
- Apr 7, 2026
- Reserved
- Jan 10, 2026
Description
Owlfiles File Manager 12.0.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the path parameter in HTTP server endpoints. Attackers can craft URLs targeting the download and list endpoints with embedded script tags to execute arbitrary JavaScript in users' browsers.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 5.0 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Owlfiles File ManagerSkyjos |
|
References
- ExploitDB-51036exploit
- Vendor Homepageproduct
- Official App Store Listingproduct
- VulnCheck Advisory: Owlfiles File Manager 12.0.1 Cross-Site Scripting via HTTP Serverthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.