CVE-2026-72594
A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject
CVSS
7.6
Alto
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 10 ago 2026 · Última mod.: 10 ago 2026 · CWE-79
Sin historial EPSS suficiente todavía.
A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar. The avatar upload handler derives the stored file extension and S3 content type from the original filename rather than inspecting file content, enabling an attacker to store an SVG containing a script element that executes in the browser of any user who views the attacker's profile or avatar.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-725835.4 MED—
——0A stored cross-site scripting (XSS) vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check. The pkg/rclonefs/base.go PutMultipart function validates the Content-Type header supplied by the client rather than inspecting the actual file content, enabling an attacker to rename a file to .jpg while specifying image/svg+xml to bypass the filter and store a script-bearing SVG in the web root.2hCVE-2026-725765.4 MED—
——0A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. The /admin/ajax/logo-upload endpoint in bl-kernel/ajax/logo-upload.php moves the uploaded file directly to the web root via Filesystem::mv() without invoking sanitizeSVG() or transformImage(), while SVG is present in the ALLOWED_IMG_EXTENSION and ALLOWED_IMG_MIMETYPES allow-lists. A stored script tag in the SVG executes in the browser of any user who loads the logo.2hCVE-2026-725705.4 MED—
——0A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters. The lib/helper/html.js file does not sanitize filenames before embedding them in HTML templates at line 28, enabling script execution in other users' browsers when they view the file listing.2hCVE-2026-572796.8 MED—
——0Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product.5hCVE-2026-193784.3 MED—
——0A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/task_id/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.13hCVE-2026-71502—50.0%
——15CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data.
An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue expression using the application's configured [[ ... ]] delimiters. User profile names may provide an additional injection vector. Although Jinja HTML escaping is applied, the resulting value is subsequently included in a DOM region compiled by Vue.
Vue interprets the attacker-controlled value as a template expression rather than ordinary text. By accessing the JavaScript Function constructor from within the expression, an attacker can execute arbitrary JavaScript in the security context of the CTI-Transmute origin. The application's nonce-based Content Security Policy does not prevent exploitation because the Vue runtime compiler requires the unsafe-eval policy exception.
The malicious payload is stored by the application and executed whenever another user opens an affected page, such as the public conversion detail page. The victim may be a normal user or an administrator. Successful exploitation could allow the attacker to:
* Access data available to the victim through the application.
* Extract API keys, tokens, or other sensitive information exposed to the page.
* Perform authenticated actions using the victim's session.
* Modify conversions or other application data.
* Escalate the impact by targeting an administrator.
A demonstrated payload can use [].constructor.constructor(...) to obtain the JavaScript Function constructor and execute arbitrary code. The regression tests also show that a short first-stage payload could retrieve an uncapped conversion description and evaluate a larger second-stage payload.
The patch addresses the vulnerability by registering a global Jinja finalize hook that inserts a zero-width Unicode word joiner inside every Vue delimiter found in server-rendered values. This prevents Vue from recognizing the values as template expressions while preserving their visible representation.2d