CVE-2026-96535
Received Received - Intake

Cross-Site Scripting in YouMind Portal via SVG Avatar

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The file is served by the CDN with Content-Type: image/svg+xml and, when navigating directly to that URL, the script executes within the context of the CDN’s domain.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-96535
EUVD
EUVD-2026-98362

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
YouMind YouMind web application 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in the YouMind web application. It occurs when updating a user's avatar via an arbitrary URL. An attacker can upload an SVG image containing embedded JavaScript code as a profile picture. When the file is served by the CDN with the Content-Type: image/svg+xml header, the script executes within the context of the CDN’s domain.

Detection Guidance

Check for SVG files served with Content-Type: image/svg+xml that may contain embedded JavaScript. Inspect avatar update endpoints for improper input validation. Monitor CDN responses for unexpected script execution.

Impact Analysis

An attacker could exploit this to execute malicious scripts in your browser when you view the SVG avatar. This could lead to theft of session cookies, account takeover, or unauthorized actions on your behalf within the YouMind application.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations using YouMind may face compliance risks due to potential data breaches or unauthorized data exposure.

Mitigation Strategies

Disable SVG uploads via arbitrary URLs. Implement strict input validation for SVG content. Sanitize SVG files to remove embedded scripts. Update Content-Type headers to prevent execution. Monitor for unauthorized avatar changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96535. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart