CVE-2026-16889
CVE-2026-16889 · Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone.
CVSS 4.8 · Media · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
openequella
- Versiones
- ≥ 2019.1, < 2026.1: Afectada (custom)
Actualiza a 2026.1