CVE-2026-82838
Received Received - Intake

SVG File Upload Allows JavaScript Execution in Venueless

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: rami.io

Description
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82838
EUVD
EUVD-2026-68392

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
venueless venueless to 7dff888 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability involves the default Docker image for Venueless not properly restricting executable JavaScript in uploaded SVG files due to an incorrect Content Security Policy (CSP). This could allow malicious SVG files to execute JavaScript when served, potentially leading to cross-site scripting (XSS) attacks.

Detection Guidance

Check if your Venueless instance is running a version prior to commit 7dff888 by inspecting the deployed image or container. Verify the Content Security Policy (CSP) headers in responses from the server to ensure they properly restrict executable JavaScript in SVG files.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript in the context of a user's browser session, potentially stealing sensitive data, performing actions on behalf of the user, or spreading malware. The impact depends on user privileges and system configuration.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance breaches if user data is compromised through XSS attacks.

Mitigation Strategies

Upgrade to Venueless version 7dff888 or later to apply the CSP fix. If immediate upgrade is not possible, review and update the CSP configuration to block executable JavaScript in SVG files. Remove or sanitize any existing SVG uploads that may contain malicious content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82838. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart