{"id":"CVE-2020-35305","aliases":["EUVD-2022-6330","GHSA-fj2w-qmjp-3rjm"],"status":"published","title":"Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog","description":"Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0079,"percentile":0.56601,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-07-15T13:40:53Z","modified":"2026-10-20T10:54:20Z","fixes":[{"ecosystem":"RubyGems","package":"gollum","fixed_in":["5.1.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"gollum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.1.2"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"gollum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.1.2"}]}],"versions":["5.0.0","5.0.1","5.1","5.1.1"]}],"products":[{"vendor":"gollum_project","product":"gollum"}],"references":[{"url":"https://github.com/Szarny/","tags":["x_refsource_MISC","x_transferred","Not Applicable","web"]},{"url":"https://github.com/gollum/","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","advisory"]},{"url":"https://github.com/gollum/gollum/releases/tag/v5.1.2","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35305","tags":["advisory"]},{"url":"http://gollum.com","tags":["web"]},{"url":"https://github.com/gollum/gollum/commit/137728cdabc0f60859fcd30404ad2b8fff6ef715","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/gollum/CVE-2020-35305.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fj2w-qmjp-3rjm"},{"url":"https://github.com/Szarny","tags":["web"]},{"url":"https://github.com/gollum","tags":["web"]},{"url":"https://github.com/gollum/gollum","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-35305","description":"Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.","status":"published","published":"2022-07-15T13:40:53Z","modified":"2026-07-09T00:12:18.306Z","updated_at":"2026-11-02T14:35:57.975444Z"}],"euvd":[{"id":"EUVD-2022-6330","description":"Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.","status":"published","published":"2022-07-15T13:40:53Z","modified":"2026-07-09T00:12:18Z","updated_at":"2026-11-02T18:20:09.112703Z"}],"ghsa":[{"id":"GHSA-fj2w-qmjp-3rjm","title":"Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog","description":"Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.","status":"published","published":"2022-07-16T00:00:28Z","modified":"2023-01-30T05:00:59Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:26.667347Z"}],"nvd":[{"id":"CVE-2020-35305","description":"Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.","status":"published","published":"2022-07-15T14:15:09.343Z","modified":"2026-07-09T01:16:45.717Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:46.951463Z"}],"osv":[{"id":"CVE-2020-35305","description":"Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.","status":"published","published":"2022-07-15T14:15:09.343Z","modified":"2026-10-20T10:54:20.041771828Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"GHSA-fj2w-qmjp-3rjm","title":"Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog","description":"Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.","status":"published","published":"2022-07-16T00:00:28Z","modified":"2024-02-16T08:20:48.053959Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:46.39441Z"}]}}