CVE-2026-129172

Description

EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoint PUT /api/v1/restores/json/resources/:id, which accepts a resource kind of image paired with a text/html MIME type without checking consistency. Authenticated members can share the note and send the public blob link to a victim, whose browser executes the script to mint a non-expiring API token granting read and write access to the victim's notes.

References

• https://github.com/tianma-if/edgeever/blob/eeaab088f41d0417fbce2266f58ff4adde7f5d76/apps/api/src/backup-routes.ts#L487-L550
• https://github.com/tianma-if/edgeever/blob/eeaab088f41d0417fbce2266f58ff4adde7f5d76/apps/api/src/share-routes.ts#L77-L80
• https://github.com/tianma-if/edgeever/commit/dc5a55a1c26d6add0e28d95dc0b282c611692e34
• https://github.com/tianma-if/edgeever/issues/701
• https://vul.yulun.ac.cn/20261028/edgeever/