[KVE-2025-0510] Stored XSS (bypass html_purify patch) to RCE 취약점 수정

2025-08-27 11:48:36 +09:00
parent 5da91ab73e
commit f69b66dced
5 changed files with 46 additions and 39 deletions
--- a/plugin/htmlpurifier/extend.video.php
+++ b/plugin/htmlpurifier/extend.video.php
@ -95,7 +95,10 @@ if( !class_exists('HTMLPurifierContinueParamFilter') ){
            }
            
            if ($query) {
-                if (isset($query_params['continue'])) {
+                
+                parse_str($query, $query_params);
+                
+                if (isset($query_params['continue']) || isset($query_params['pcurl'])) {
                    return false;
                }
            }