Stored cross-site scripting in LibreDesk via SVG uploads
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting flaw, tracked as CWE-79, in its media upload handling. An authenticated agent can upload an SVG file with a malformed Content-Type parameter, and the upload is then served inline without a sandbox. Script in the SVG runs in the session of any agent or administrator who views it.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade abhinavxd LibreDesk to version 2.9.0-rc.8 or later, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA libredesk (abhinavxd) Fixed in 2.9.0-rc.8
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111168
References
Patch 2
Other 4
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences