CVE-2026-26272
Stored XSS via Unrestricted File Upload in HomeBox Attachments
Publication date: 2026-03-03
Last updated on: 2026-03-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sysadminsmedia | homebox | to 0.23.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade the HomeBox application to version 0.24.0-rc.1 or later, where the issue is fixed.
Additionally, restrict or validate uploaded file types to prevent uploading of malicious HTML, SVG, or other script-containing files.
Ensure that only authenticated and trusted users have permission to upload attachments.
Can you explain this vulnerability to me?
This vulnerability is a stored cross-site scripting (XSS) issue in the HomeBox application prior to version 0.24.0-rc.1. It occurs in the item attachment upload functionality where the application does not properly validate or restrict the types of files that authenticated users can upload. Malicious users can upload HTML or SVG files containing executable JavaScript, or potentially other file formats that can render scripts. When other users access these uploaded files via direct links, the embedded JavaScript executes within the context of the application's origin, potentially compromising security.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to execute arbitrary JavaScript code in the context of the HomeBox application for users who access the malicious attachments. This can lead to unauthorized actions such as stealing user session information, performing actions on behalf of the user, or delivering further malicious payloads. Since the vulnerability requires an authenticated user to upload the malicious file and another user to access it, the impact includes potential compromise of user data confidentiality and integrity.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know