CVE-2026-120428
Received Received - Intake

Stored XSS in PandaWiki via Malicious File Upload

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda_wiki_token JWT for session takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120428

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Chaitin PandaWiki 3.65.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in PandaWiki versions 3.65.0 through 3.87.5. It allows unauthenticated attackers to upload HTML files disguised as images via the /share/v1/common/file/upload endpoint. The attack bypasses file validation by tricking the system into accepting HTML files with image extensions. When accessed via a crafted URL like /static-file/<key>?a=.pdf, the browser renders the file as HTML instead of downloading it, enabling script execution to steal admin session tokens.

Detection Guidance

Check PandaWiki versions between 3.65.0 and 3.87.5. Inspect file upload endpoints for improper validation. Look for HTML files with image extensions in /share/v1/common/file/upload. Monitor access logs for /static-file/<key>?a=.pdf requests.

Impact Analysis

If you are an administrator or user with access to PandaWiki, this vulnerability could allow attackers to steal your session token (panda_wiki_token JWT) by tricking you into clicking a malicious link. This could lead to unauthorized access to your account, potential data theft, or further compromise of the system. Even if you are not an admin, attackers might use your session to perform actions on your behalf.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles (e.g., integrity and confidentiality) and HIPAA's security requirements for protected health information. If exploited, it may result in data breaches, non-compliance with access controls, and potential legal penalties due to unauthorized exposure of personal or health data.

Mitigation Strategies

Upgrade PandaWiki to a patched version. Implement strict file type validation beyond extension checks. Configure nginx to enforce Content-Disposition: attachment headers. Disable direct HTML rendering for uploaded files. Restrict admin access to sensitive endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120428. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...