CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 5.4. It affects Java.
CVE
CVE-2026-5026
Severity
MEDIUM
CVSS
5.4
EPSS
0.15%
Java
Original NVD Description
The '/api/v1/files/images/{flow_id}/{file_name}' endpoint serves SVG files with the 'image/svg+xml' content type without sanitizing their content. Since SVG files can contain embedded JavaScript, an attacker can upload a malicious SVG that executes arbitrary JavaScript when viewed by other users, leading to stored cross-site scripting (XSS). This allows stealing authentication tokens stored in cookies, including JWT access and refresh tokens.
Related CVEs
Other vulnerabilities affecting the same vendor(s)