CVE-2026-63148
CVE-2026-63148 · Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_FILES. Attackers can submit a crafted filename that is stored and later rendered in components such as the dashboard controller (CtrlDashboard), executing arbitrary script in the browsers of users who view the affected page.
CVSS 5.1 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
agora project
- Versions
- ≥ 0, < 26.10.0: Affected (semver)
Update to 26.10.0