Jirafeau is a niche file-sharing and temporary-storage application that handles user-uploaded content and generates dynamic web pages to manage access and sharing. Its durable vulnerability signal reflects the product's role in user-input processing and session management, with recurring exposure in cross-site scripting and cross-site request forgery weaknesses. Current severity, exploitation activity, and CVE counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Jirafeau over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-11349HIGH The administration panel of Jirafeau before 3.4.1 is vulnerable to three CSRF attacks on search functionalities: search_by_name, search_by_hash, and search_link. | Jul 7, 2018 | 8.8 | 25 | NO | NO |
CVE-2026-1466MEDIUM Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scripting. This was done | Jan 28, 2026 | 6.1 | 21 | NO | NO |
CVE-2022-30110MEDIUM The file preview functionality in Jirafeau < 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/svg+xml files containin | May 17, 2022 | 6.1 | 20 | NO | NO |
CVE-2018-11351MEDIUM script.php in Jirafeau before 3.4.1 is affected by two stored Cross-Site Scripting (XSS) vulnerabilities. These are stored within the shared files description file and allow the ex | Jul 7, 2018 | 6.1 | 20 | NO | NO |
CVE-2025-7066MEDIUM Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scripting. This was done | Jul 4, 2025 | 6.1 | 19 | NO | NO |
CVE-2024-12326MEDIUM Jirafeau normally prevents browser preview for SVG files due to the possibility that manipulated SVG files could be exploited for cross site scripting. This was done by storing the | Dec 6, 2024 | 6.1 | 19 | NO | NO |
CVE-2018-11350MEDIUM An issue was discovered in Jirafeau before 3.4.1. The file "search by name" form is affected by one Cross-Site Scripting vulnerability via the name parameter. | Jul 7, 2018 | 6.1 | 19 | NO | NO |
CVE-2018-13409MEDIUM An issue was discovered in Jirafeau before 3.4.1. The "search file by hash" form is affected by reflected XSS that could allow, by targeting an administrator, stealing a session an | Jul 6, 2018 | 6.1 | 18 | NO | NO |
CVE-2018-13408MEDIUM An issue was discovered in Jirafeau before 3.4.1. The "search file by link" form is affected by reflected XSS that could allow, by targeting an administrator, stealing a session an | Jul 6, 2018 | 6.1 | 18 | NO | NO |
CVE-2018-13407MEDIUM A CSRF issue was discovered in Jirafeau before 3.4.1. The "delete file" feature on the admin panel is not protected against automated requests and could be abused. | Jul 6, 2018 | 4.9 | 16 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Jirafeau.
Media articles that mention a CVE ID that affects a product developed by Jirafeau — matched by CVE ID, not by vendor name.