CVE-2026-126946
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages.