CVE-2026-126771
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Nov 11, 2026
Vendor
unknown
Description
OpsTree REMS through 1.0.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts by uploading attachments with spoofed text/html Content-Type. Attackers can upload HTML files named like test.html.pdf that render in the REMS origin via Preview, executing JavaScript in victims' browsers.