CVE-2026-124435
Received Received - Intake

Stored XSS in OpenRemote via Malicious File Upload

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with write:admin permissions to upload HTML or SVG files containing JavaScript via the Manager configuration file upload endpoint. Attackers can lure victims to the unauthenticated image retrieval endpoint, which serves files as text/html or image/svg+xml, executing scripts within the application's origin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124435
EUVD
EUVD-2026-119565

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openremote openremote to 1.32.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in OpenRemote versions before 1.32.2. Authenticated users with write:admin permissions can upload HTML or SVG files containing malicious JavaScript via the Manager configuration file upload endpoint. These files are stored and served as text/html or image/svg+xml through an unauthenticated image retrieval endpoint, executing scripts within the application's origin.

Detection Guidance

Check the Manager configuration images directory for unexpected HTML or SVG files. In Docker deployments, inspect /storage/manager/images/ for files that may contain malicious JavaScript. Review uploaded files via the Manager configuration file upload endpoint POST /api/{realm}/configuration/manager/file.

Impact Analysis

An attacker could exploit this to execute unauthorized actions, steal sensitive information, or perform phishing attacks within the application's context. Victims may unknowingly trigger the malicious script by accessing the unauthenticated image retrieval endpoint.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed or altered due to the XSS attack.

Mitigation Strategies

Upgrade to OpenRemote version 1.32.2 or later. Inspect the Manager configuration images directory for malicious files. Validate file uploads to reject dangerous file types. Rename the upload endpoint to POST /configuration/manager/image if not already updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124435. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...