CVE-2026-18682

Received Received - Intake

Cross-Site Scripting in OpenAkita File Upload API

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulDB

Description

A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-03

Generated

2026-08-04

AI Q&A

2026-08-04

EPSS Evaluated

N/A

NVD

CVE-2026-18682

Affected Vendors & Products

Vendor	Product	Version / Range
openakita	openakita	to 1.27.12 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) flaw in OpenAkita versions up to 1.27.12. It exists in the File Upload API component, specifically in the /api/upload file. The issue arises when the 'File' argument is manipulated, allowing attackers to inject malicious scripts. The exploit is considered difficult but has been publicly disclosed.

Impact Analysis

An attacker could exploit this to execute malicious scripts in a user's browser, potentially stealing session cookies, redirecting users to phishing sites, or performing actions on their behalf. The impact depends on user privileges and the sensitivity of data processed by the application.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations may face compliance violations if user data is compromised through this flaw.

Mitigation Strategies

Immediately upgrade OpenAkita to a version beyond 1.27.12 where the vulnerability is patched. If an upgrade is not available, disable the File Upload API component or restrict access to the /api/upload endpoint. Monitor network traffic for unusual activity targeting this component.

Hi! I’m here to help you understand CVE-2026-18682. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70