CVE-2026-75529

Received Received - Intake

Stored XSS in Pandora PDF Download Functionality

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: CIRCL

Description

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/<task_id>/.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using send_file(task.file.path) without explicitly specifying the MIME type or forcing it to be downloaded as an attachment. Because Flask determines the response MIME type from the filename when a path is supplied, an attacker could submit a file whose content is recognized by Pandora as a PDF while its filename or extension causes the download endpoint to return it with a different, potentially active MIME type. A specially crafted PDF/polyglot file could therefore be served inline and interpreted by a victim's browser as HTML or another executable web format. If a victim with access to the submitted analysis follows the PDF download link, attacker-controlled script could execute in the security context of the Pandora application, potentially allowing access to application data or actions using the victim's session. The patch prevents the issue by explicitly returning PDF downloads with Content-Type: application/pdf, forcing Content-Disposition: attachment, and assigning a trusted .pdf filename based on the task UUID.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-75529

Affected Vendors & Products

Vendor	Product	Version / Range
pandora	pandora	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Pandora has a stored cross-site scripting (XSS) vulnerability in its PDF download feature. The /task-download/<task_id>/.../pdf endpoint checks if a file is a PDF using content-based detection but fails to enforce a PDF MIME type when sending the file. An attacker can upload a file that Pandora recognizes as a PDF but has a filename or extension that tricks the browser into interpreting it as HTML or another executable format. When a victim downloads and opens the file, malicious script can execute in the context of the Pandora application, potentially accessing sensitive data or performing actions on behalf of the victim.

Detection Guidance

Check for unusual PDF downloads from the /task-download/<task_id>/.../pdf endpoint. Monitor network traffic for files served with incorrect MIME types. Inspect server logs for requests to this endpoint with non-PDF filenames.

Impact Analysis

If you use Pandora and download a specially crafted PDF from an attacker, malicious script could run in your browser session. This could allow the attacker to steal your session data, access application information, or perform unauthorized actions while impersonating you within Pandora. The impact depends on your permissions in Pandora and the sensitivity of the data you can access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR (data protection) or HIPAA (health information privacy) requirements. If exploited, it could result in data breaches, unauthorized disclosures, or loss of control over personal or protected health information, potentially leading to legal and regulatory penalties.

Mitigation Strategies

Apply the patch that explicitly sets Content-Type: application/pdf and Content-Disposition: attachment for PDF downloads. Ensure all PDF downloads use a trusted .pdf filename based on the task UUID.

Hi! I’m here to help you understand CVE-2026-75529. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70