CVE-2026-63147

Deferred Deferred - Pending Action

Stored XSS in Omnispace Agora Project

Publication date: 2026-10-13

Last updated on: 2026-10-17

Assigner: VulnCheck

Description

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploading a file with HTML/script markup embedded in its filename, which bypasses the paramFilter since uploaded-file names arrive through $_FILES rather than $_GET/$_POST. Attackers can upload a file with a crafted name such as an SVG onload payload to have the unsanitized filename stored and later rendered to other users, resulting in script execution in their browsers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-17

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-63147

EUVD

EUVD-2026-100583

Affected Vendors & Products

Vendor	Product	Version / Range
Omnispace	Agora	Project 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-63147 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project before version 26.10.0. Authenticated users can inject malicious scripts by uploading a file with HTML or script markup in its filename. The paramFilter fails to sanitize filenames because they arrive via $_FILES instead of $_GET/$_POST. Attackers can upload a file with a crafted name like an SVG containing an onload payload, which executes when other users access it.

Detection Guidance

Check for uploaded files with suspicious filenames containing HTML/script tags or event handlers like onload. Inspect file upload logs for filenames with payloads such as .svg onload=alert(1). Use network monitoring tools to detect unsanitized filename storage in the application.

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in the browsers of users who access the uploaded file. This could lead to session hijacking, data theft, or unauthorized actions on behalf of the user. The impact depends on user privileges and the sensitivity of the data involved.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized access to sensitive data or user sessions. Stored XSS may lead to data breaches, which are reportable under these regulations, potentially resulting in fines or legal consequences.

Mitigation Strategies

Upgrade Omnispace Agora Project to version 26.10.0 or later. Implement strict filename sanitization to remove or encode HTML/script characters in uploaded filenames. Validate and sanitize all user inputs, including filenames, before storage.

Hi! I’m here to help you understand CVE-2026-63147. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70