CVE-2026-129427 PUBLISHED

Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO

Assigner: Grayback
Reserved: 14.11.2026 Published: 14.11.2026 Updated: 14.11.2026

Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS Score: 8.7

Product Status

Vendor CervantesSec
Product cervantes
Versions Default: unaffected
  • affected from alpha 0.3 to 1.3-beta (incl.)
  • Version v.1.4.0-beta is unaffected

Credits

  • Miguel Segovia Gil finder

References

Problem Types

  • CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') CWE