Github.Com Gotify Server vulnerabilities

[MEDIUM] CWE-79 Reflected XSS in Gotify's /docs via import of outdated Swagger UI Reflected XSS in Gotify's /docs via import of outdated Swagger UI ### Impact Gotify exposes an outdated instance of the [Swagger UI](https://swagger.io/tools/swagger-ui/) API documentation frontend at `/docs` which is susceptible to reflected XSS attacks when loading external Swagger config files. Specifically, the DOMPurify version included with this version of Swagger UI is vulnerable to a [rendering XSS](http

CVE-2022-46181 [MEDIUM] CWE-79 gotify/server vulnerable to Cross-site Scripting in the application image file upload gotify/server vulnerable to Cross-site Scripting in the application image file upload ### Impact The XSS vulnerability allows authenticated users to upload .html files. With that, an attacker could execute client side scripts **if** another user opened a link, such as: ``` https://push.example.org/image/[alphanumeric string].html ``` An attacker could potentially take over the