{"id":"CVE-2020-15907","details":"In Mahara 19.04 before 19.04.6, 19.10 before 19.10.4, and 20.04 before 20.04.1, certain places could execute file or folder names containing JavaScript.","modified":"2026-07-08T20:58:39.492399Z","published":"2020-08-07T20:15:12.437Z","references":[{"type":"ADVISORY","url":"https://mahara.org/interaction/forum/topic.php?id=8668"},{"type":"FIX","url":"https://bugs.launchpad.net/mahara/+bug/1888163"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/maharaproject/mahara","events":[{"introduced":"d98eee64dc05a1b1fa163b033f0443b5dd6fde92"},{"fixed":"b0622b0df0573c4455dd0bc3a431b92997f4dc7a"},{"introduced":"6baa307ceb0dfb0292f13b5f23410af77017ee96"},{"fixed":"9373e383bf172a88baec252004ca6e71d78f18de"},{"introduced":"0ac1f94a973e467134edc7b94cb65318eb19227f"},{"fixed":"d52c5ff143810e5b2e6ca06a2ee509ba8c5c1f14"}],"database_specific":{"extracted_events":[{"introduced":"19.04"},{"fixed":"19.04.6"},{"introduced":"19.10"},{"fixed":"19.10.4"},{"introduced":"20.04"},{"fixed":"20.04.1"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*"}}],"versions":["19.10.3_RELEASE","19.04.5_RELEASE","20.04.0_RELEASE","19.10.2_RELEASE","19.04.4_RELEASE","19.04.3_RELEASE","19.10.1_RELEASE","19.04.2_RELEASE","19.10.0_RELEASE","19.04.1_RELEASE","19.04.0_RELEASE"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15907.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}