CVE-2026-29971
Reflected XSS in WebFileSys 2.31.1 Enables Arbitrary Script Execution
Publication date: 2026-04-27
Last updated on: 2026-04-28
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| webfilesys | webfilesys | 2.31.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this reflected cross-site scripting (XSS) vulnerability in WebFileSys, you should upgrade the software to version 2.32.0 or later, where the issue has been fixed.
Can you explain this vulnerability to me?
This vulnerability is a reflected cross-site scripting (XSS) issue in WebFileSys version 2.31.1. It occurs because user-controlled input is reflected into HTML and JavaScript contexts without proper output encoding. This allows an attacker to inject and execute arbitrary JavaScript code in the victim's browser.
How can this vulnerability impact me? :
The impact of this vulnerability is that an attacker can execute arbitrary JavaScript in the context of the victim's browser. This can lead to theft of sensitive information such as cookies or session tokens, manipulation of web page content, or performing actions on behalf of the victim without their consent.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The reflected cross-site scripting (XSS) vulnerability in WebFileSys allows attackers to execute arbitrary JavaScript in a victim's browser, which can lead to session hijacking, credential theft, and unauthorized actions within authenticated sessions.
Such impacts can compromise the confidentiality and integrity of user data, potentially violating data protection requirements under standards like GDPR and HIPAA that mandate safeguarding personal and sensitive information against unauthorized access and breaches.
Therefore, this vulnerability could negatively affect compliance with these regulations by exposing user data to unauthorized parties and increasing the risk of data breaches.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This reflected XSS vulnerability in WebFileSys can be detected by testing the affected components such as ftpBackup functionality, authentication input handling, search functionality, and error message rendering for improper output encoding of user-controlled input.
One practical approach is to inject typical XSS payloads into input fields or URL parameters and observe if the payload is reflected and executed in the browser.
- Use curl or similar tools to send crafted requests with payloads like `<IMG SRC="javascript:alert('XSS')">`, `%3CScRiPt%3Ealert(1)%3C%2FsCriPt%3E`, or `anythinglr00</script><script>alert(document.domain)</script>` to the login page or other affected endpoints.
- Example curl command to test the login page input parameter (replace URL and parameter accordingly): curl -v --data-urlencode "username=<IMG SRC=javascript:alert('XSS')>" https://target-webfilesys/login
- Monitor the HTTP response and the behavior in a browser to check if the injected script executes, indicating the presence of the vulnerability.