CVE-2026-129430
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Nov 14, 2026
Vendor
unknown
Description
Axeloz Filesharing before 2.14.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script by storing raw HTML or javascript: Markdown links in bundle descriptions. Recipients viewing the public bundle preview page execute the script via Alpine x-html, letting attackers steal the owner_token from localStorage and issue owner-scoped requests against victim bundles.
References
- https://github.com/axeloz/filesharing
- https://github.com/axeloz/filesharing/blob/e865be1f09f8eb5a46c4b9a16635de892b093d8f/app/Http/Resources/BundleResource.php#L33
- https://github.com/axeloz/filesharing/commit/366ee452aba636858d55b82068ecc35f6d08b6d6
- https://github.com/axeloz/filesharing/commit/eebc80a77c0e3fe3b8467245ba89fa49f2d35928
- https://github.com/axeloz/filesharing/pull/90