CVE-2021-27902: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-06-30T12:15Z
Repository: https://github.com/craftcms/cms
Language: Markdown
Files changed: CHANGELOG-v3.6.md, CHANGELOG.md, src/config/GeneralConfig.php
Commit date: 2021-01-22 16:27:34 -0800
Commit message: Stop allowing .htm + .html by default

Diff: diff --git a/CHANGELOG-v3.6.md b/CHANGELOG-v3.6.md
index 3734af06a0..06d3055981 100644
--- a/CHANGELOG-v3.6.md
+++ b/CHANGELOG-v3.6.md
@@ -217,5 +217,8 @@
 - Fixed a bug where `craft\helpers\Db::prepareValuesForDb()` would omit or JSON-encode `DateTime` objects, depending on the PHP version, rather than converting them to ISO-8601-formatted strings.
 - Fixed a bug where info icons’ content was focusable before the icon was activated. ([#7257](https://github.com/craftcms/cms/issues/7257))
 - Fixed a bug where generated URLs would include the token from the current request, even if it had expired or met its usage limit.
 - Fixed a bug where Number field settings and input values could be stored incorrectly if the user’s formatting locale used a different decimal character that the application language.
 - Fixed a MySQL deadlock error that could occur when running background jobs. ([#7179](https://github.com/craftcms/cms/issues/7179))
+
+### Security
+- The default `allowedFileExtensions` config setting value no longer includes `htm` or `html`.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e8eea8f8ab..f997c81a06 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,10 +9,13 @@
 - Exception JSON responses now include `exception`, `file`, `line`, and `trace` keys. ([#7406](https://github.com/craftcms/cms/issues/7406))
 
 ### Fixed
 - Fixed a bug where D3-formatted numbers were getting extra `.00`s added to them if the Intl extension wasn’t installed. ([#7402](https://github.com/craftcms/cms/issues/7402))
 
+### Security
+- The default `allowedFileExtensions` config setting value no longer includes `htm` or `html`.
+
 ## 3.6.0-RC4 - 2020-01-19
 
 ### Added
 - Added tablet and phone viewport emulation to Live Preview (Craft Pro only.) ([#1006](https://github.com/craftcms/cms/issues/1006))
 - URL fields now have an “Allowed URL Types” setting, which adds the ability to accept telephone and email URLs. ([#5497](https://github.com/craftcms/cms/issues/5497))
diff --git a/src/config/GeneralConfig.php b/src/config/GeneralConfig.php
index e64252e87d..65e65f6ec8 100644
--- a/src/config/GeneralConfig.php
+++ b/src/config/GeneralConfig.php
@@ -131,12 +131,10 @@ class GeneralConfig extends BaseObject
         'fla',
         'flv',
         'gif',
         'gz',
         'gzip',
-        'htm',
-        'html',
         'itt',
         'jp2',
         'jpeg',
         'jpg',
         'jpx',

Vulnerable code:         'htm',
        'html',
Fixed code: 
### Security
- The default `allowedFileExtensions` config setting value no longer includes `htm` or `html`.
### Security
- The default `allowedFileExtensions` config setting value no longer includes `htm` or `html`.