CVE-2015-5204: Apache Cordova File Transfer

Medium severity, CVSS 4.3. EPSS: 3.4% chance of exploitation in the next 30 days.

CRLF injection vulnerability in the Apache Cordova File Transfer Plugin (cordova-plugin-file-transfer) for Android before 1.3.0 allows remote attackers to inject arbitrary headers via CRLF sequences in the filename of an uploaded file.

Affected products

• Apache Cordova File Transfer: up to and including 1.2.1

Published 2015-12-17. Last modified 2026-06-17.