Summary

In the latest v6.0.0 version, the endpoint/admin/tag/list does not encode user-controllable parameters when outputting them on the current page, resulting in Reflected XSS. This allows attackers to launch XSS attacks against administrator users.

POC

http://localhost:8888/admin/tag/list?name=%22%3E%3Csvg%2Fonload%3Dconfirm%289%29%3E