CVE-2026-40126
Received Received - Intake

DOM-based XSS in OutSystems Service Center via Malicious Filename

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: CERT.PL

Description
OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting (XSS) attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where a file can be attached and prepared for upload to the server. This issue was fixed in OutSystems Service Center version 11.41.2

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-40126
EUVD
EUVD-2026-60159

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
outsystems service_center to 11.41.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-40126 is a DOM-based Cross-Site Scripting (XSS) vulnerability in OutSystems Service Center. A low-privileged attacker can exploit it by uploading a file with a malicious filename containing JavaScript code. This affects all file attachment locations where files are prepared for upload.

Detection Guidance

Detecting this vulnerability requires checking for DOM-based XSS in file upload functionalities. Inspect network traffic for file upload requests with malicious filenames containing JavaScript code. Use browser developer tools to monitor DOM changes when uploading files. Check server logs for unusual file upload patterns or errors during processing.

Impact Analysis

An attacker could execute arbitrary JavaScript in a victim's browser when they view the malicious filename. This could lead to session hijacking, data theft, or unauthorized actions on behalf of the user.

Compliance Impact

This DOM-based XSS vulnerability could potentially lead to unauthorized data access or manipulation, which may impact compliance with GDPR (data protection) and HIPAA (healthcare data privacy) by exposing sensitive user data or violating confidentiality requirements.

Mitigation Strategies

Immediately upgrade OutSystems Service Center to version 11.41.2 or later. If upgrading is not possible, disable file upload functionality in affected locations or implement strict filename validation to block JavaScript code in filenames. Monitor for any suspicious activity related to file uploads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40126. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart