{"id":"CVE-2026-111168","aliases":["EUVD-2026-102295","GHSA-wvrw-g5q5-xxgm"],"status":"published","title":"LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter","description":"LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00226,"percentile":0.13418,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-10-15T18:57:54Z","modified":"2026-10-28T02:30:51Z","products":[{"vendor":"abhinavxd","product":"libredesk"}],"references":[{"url":"https://github.com/abhinavxd/libredesk/pull/641","tags":["patch","issue-tracking","fix"]},{"url":"https://github.com/abhinavxd/libredesk/commit/ab3a5ca682fcc1caec0950fc607b66caea49bec3","tags":["patch","fix"]},{"url":"https://github.com/abhinavxd/libredesk/blob/086b08200d667f2cc083635e925d6f5e7b0097e3/cmd/media.go#L255-L272","tags":["technical-description","article"]},{"url":"https://github.com/abhinavxd/libredesk/blob/086b08200d667f2cc083635e925d6f5e7b0097e3/internal/media/media.go#L422-L433","tags":["technical-description","article"]},{"url":"https://github.com/abhinavxd/libredesk/releases/tag/v2.9.0-rc.8","tags":["release-notes","advisory"]},{"url":"https://github.com/abhinavxd/libredesk","tags":["product","package"]},{"url":"https://www.vulncheck.com/advisories/libredesk-before-2.9.0-rc.8-stored-xss-via-svg-upload-content-type-parameter","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111168","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wvrw-g5q5-xxgm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111168.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-111168","title":"LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter","description":"LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.","status":"published","published":"2026-10-15T18:57:54.024Z","modified":"2026-10-15T19:40:44.232Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:15.34316Z"}],"euvd":[{"id":"EUVD-2026-102295","description":"LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.","status":"published","published":"2026-10-15T18:57:54Z","modified":"2026-10-15T19:40:44Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:00:10.305867Z"}],"ghsa":[{"id":"GHSA-wvrw-g5q5-xxgm","title":"LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows...","description":"LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.","status":"published","published":"2026-10-15T21:36:08Z","modified":"2026-10-15T21:36:16Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:13:49.297576Z"}],"nvd":[{"id":"CVE-2026-111168","description":"LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.","status":"published","published":"2026-10-15T19:17:32.827Z","modified":"2026-10-16T18:25:45.343Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:59.751798Z"}],"osv":[{"id":"CVE-2026-111168","title":"LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter","description":"LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.","status":"published","published":"2026-10-15T18:57:54.024Z","modified":"2026-10-28T02:30:51.226272159Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:55.61515Z"}]}}