TI-2026-21242 Aliases CVE-2026-26272

HomeBox affected by Stored XSS via HTML/SVG Attachment Upload

LOW 24CWE-79Published 2026-03-03 · Updated 2026-03-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, a stored cross-site scripting (XSS) vulnerability exists in the item attachment upload functionality. The application does not properly validate or restrict uploaded file types, allowing an authenticated user to upload malicious HTML or SVG files containing executable JavaScript (also, potentially other formats that render scripts). Uploaded attachments are accessible via direct links. When a user accesses such a file in their browser, the embedded JavaScript executes in the context of the application's origin. This vulnerability is fixed in 0.24.0-rc.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00194 9th percentileScored 2026-11-07

Fix Fixed homebox (sysadminsmedia): 0.24.0-rc.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sysadminsmedia	homebox	before 0.24.0-rc.1	0.24.0-rc.1	Patch available	CNA

homebox Vendorsysadminsmedia Affected before 0.24.0-rc.1 Fixed in 0.24.0-rc.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sysadminsmedia:homebox::::::::	up to 0.23.1	Vulnerable	sysadminsmedia

cpe:2.3:a:sysadminsmedia:homebox:*:*:*:*:*:*:*:* Versions up to 0.23.1 Vulnerable ·sysadminsmedia

Remediation

Fix · CNA homebox (sysadminsmedia) Fixed in 0.24.0-rc.1

Timeline

2026-10-02 Threatist record created from CVE-2026-26272

References

Patch 1

https://github.com/sysadminsmedia/homebox/commit/51bd04e5f4656b306a296745ddd854d45aa3b892

Advisory 1

https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-55fv-9q6q-vpcr

TI-2026-29010 HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation CVSS 3.1HIGH 8.1
TI-2026-22323 HomeBox has an Auth Rate Limit Bypass via IP Spoofing CVSS 3.1HIGH 7.4
TI-2026-21986 HomeBox affected by Blind SSRF CVSS 3.1MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences