CVE-2026-129430
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-79
Neutralización incorrecta de la entrada durante la generación de la página web (Cross-site Scripting)
Fecha de publicación:
14/11/2026
Última modificación:
14/11/2026
Descripción
*** Pendiente de traducción *** Axeloz Filesharing before 2.14.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script by storing raw HTML or javascript: Markdown links in bundle descriptions. Recipients viewing the public bundle preview page execute the script via Alpine x-html, letting attackers steal the owner_token from localStorage and issue owner-scoped requests against victim bundles.
Impacto
Puntuación base 4.0
5.10
Gravedad 4.0
MEDIA
Puntuación base 3.x
5.40
Gravedad 3.x
MEDIA
Referencias a soluciones, herramientas e información
- https://github.com/axeloz/filesharing
- https://github.com/axeloz/filesharing/blob/e865be1f09f8eb5a46c4b9a16635de892b093d8f/app/Http/Resources/BundleResource.php#L33
- https://github.com/axeloz/filesharing/commit/366ee452aba636858d55b82068ecc35f6d08b6d6
- https://github.com/axeloz/filesharing/commit/eebc80a77c0e3fe3b8467245ba89fa49f2d35928
- https://github.com/axeloz/filesharing/pull/90
- https://github.com/axeloz/filesharing/releases/tag/2.14.3
- https://www.vulncheck.com/advisories/axeloz-filesharing-before-2.14.3-stored-xss-via-bundle-description-markdown-links