Read the docs
TI-2026-20316 Aliases CVE-2026-25154

LocalSend has Stored XSS in Web Share Interface via Filename

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

LocalSend is a free, open-source app that allows users to share files and messages with nearby devices over their local network without needing an internet connection. In versions up to and including 1.17.0, when a user initiates a "Share via Link" session, the LocalSend application starts a local HTTP server to host the selected files. The client-side logic for this web interface is contained in `app/assets/web/main.js`. Note that at [0], the `handleFilesDisplay` function constructs the HTML for the file list by iterating over the files received from the server. Commit 8f3cec85aa29b2b13fed9b2f8e499e1ac9b0504c contains a patch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00316 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
localsendlocalsendup to 1.17.0—No fix listedCNA
  • localsend Vendorlocalsend Affected up to 1.17.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:localsend:localsend:*:*:*:*:*:*:*:*up to 1.17.0Vulnerablelocalsend
  • cpe:2.3:a:localsend:localsend:*:*:*:*:*:*:*:* Versions up to 1.17.0 Vulnerable ·localsend

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25154

References

Exploit 1

Patch 1

  • TI-2025-34547 LocalSend is Vulnerable to Man-in-the-Middle Attacks, Leading to File Interception CVSS 4.0CRITICAL 9.3
  • TI-2025-19999 LocalSend path traversal vulnerability in the file upload endpoint allows nearby devices to execute arbitrary commands CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences