Executive Summary

This vulnerability exists in NocoDB versions prior to 2026.05.1 when the NC_SECURE_ATTACHMENTS setting is enabled. An authenticated uploader could upload .html or .svg files that the browser would render inline from the NocoDB origin instead of forcing the files to be downloaded.

The root cause is a mismatch in how response-header overrides are stored and read: the signed attachment handler stores headers with PascalCase keys (e.g., ResponseContentDisposition), but the controller serving the file reads them using lowercase-hyphen keys (e.g., response-content-disposition). This mismatch causes the Content-Disposition: attachment header to be dropped, allowing Express to auto-render certain file types inline.

This behavior could lead to unintended inline rendering of potentially unsafe HTML or SVG files uploaded by authenticated users.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to security risks such as cross-site scripting (XSS) or content injection because .html or .svg files uploaded by authenticated users are rendered inline by the browser instead of being downloaded.

This could allow attackers to execute malicious scripts in the context of the NocoDB origin, potentially compromising user data or session information.

The impact is rated with a CVSS base score of 5.1, indicating a medium severity vulnerability that requires low privileges but user interaction.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade NocoDB to version 2026.05.1 or later, where the issue has been fixed.

Useful 0 Not Useful 0