CVE-2021-23260
Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.
Date published : 2021-12-02
https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120103