Inline file previews were not restricted to safe MIME types, allowing potentially unsafe file formats to be rendered in the browser instead of being downloaded.
This vulnerability affects the following application versions:
- Jetpack 14.6
- Jetpack 14.6.1
- Jetpack 14.6-a.7
- Jetpack 14.6-a.9
- Jetpack 14.6-beta
- Jetpack 14.7
- Jetpack 14.7.1
- Jetpack 14.7-a.1
- Jetpack 14.7-a.3
- Jetpack 14.7-a.5
- Jetpack 14.7-a.7
- Jetpack 14.7-beta
- Jetpack 14.8
- Jetpack 14.8.1
- Jetpack 14.8.1-vip.1
- Jetpack 14.8-a.1
- Jetpack 14.8-a.3
- Jetpack 14.8-a.5
- Jetpack 14.8-a.7
- Jetpack 14.8-a.9
- Jetpack 14.8-beta
- Jetpack 14.9
- Jetpack 14.9.1
- Jetpack 14.9.2
- Jetpack 14.9-a.1
- Jetpack 14.9-a.3
- Jetpack 14.9-a.5
- Jetpack 14.9-a.7
- Jetpack 14.9-beta
- Jetpack 15.0
- Jetpack 15.0.1
- Jetpack 15.0.2
- Jetpack 15.0.3
- Jetpack 15.0-a.1
- Jetpack 15.0-a.3
- Jetpack 15.0-a.5
- Jetpack 15.0-a.7
- Jetpack 15.0-beta
- Jetpack 15.0-beta.2
- Jetpack 15.0-beta.3
- Jetpack 15.1
- Jetpack 15.1.1
- Jetpack 15.1.2
- Jetpack 15.1-a.1
- Jetpack 15.1-a.11
- Jetpack 15.1-a.3
- Jetpack 15.1-a.5
- Jetpack 15.1-a.7
- Jetpack 15.1-a.9
- Jetpack 15.1-beta
- Jetpack 15.1-beta.2
- Jetpack 15.2
- Jetpack 15.2.1
- Jetpack 15.2-a.1
- Jetpack 15.2-a.3
- Jetpack 15.2-a.5
- Jetpack 15.2-a.7
- Jetpack 15.2-beta
- Jetpack 15.3-a.1
- Jetpack 15.3-a.3
- Jetpack 15.3-a.5
- Jetpack 15.3-a.7
- Jetpack 15.3-a.9
- Jetpack 15.3-beta