CVE-2026-124491
Received Received - Intake

Stored XSS in SunEditor FileUpload Plugin

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124491
EUVD
EUVD-2026-119546

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ji_hong suneditor to 3.4.0 (exc)
suneditor suneditor to 3.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SunEditor before version 3.4.0 has a stored cross-site scripting (XSS) vulnerability in its FileUpload plugin. The issue occurs when the plugin's create() method processes a server response containing a malicious filename. The server-returned filename is assigned to innerHTML without HTML escaping, allowing attackers to upload files with HTML-laden names that execute JavaScript when content or gallery items load.

Detection Guidance

Check SunEditor version with npm list suneditor or inspect package.json. If version is below 3.4.0, the system is vulnerable. Review FileUpload plugin usage in code for uploadUrl configurations.

Impact Analysis

This vulnerability can lead to session theft, unauthorized actions, or theft of sensitive data. Attackers can execute malicious JavaScript in victims' browsers when they view content or gallery items, enabling attackers to hijack sessions or perform actions on behalf of the victim.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information. The stored XSS allows attackers to steal session cookies or inject malicious scripts, potentially exposing personal or medical data.

Mitigation Strategies

Upgrade SunEditor to version 3.4.0 or later immediately. Disable FileUpload plugin if not required. Implement server-side input validation to sanitize filenames before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124491. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...