Medium severity5.4NVD Advisory· Published Mar 27, 2026· Updated Apr 20, 2026
CVE-2026-5026
CVE-2026-5026
Description
The '/api/v1/files/images/{flow_id}/{file_name}' endpoint serves SVG files with the 'image/svg+xml' content type without sanitizing their content.
Since SVG files can contain embedded JavaScript, an attacker can upload a malicious SVG that executes arbitrary JavaScript when viewed by other users, leading to stored cross-site scripting (XSS). This allows stealing authentication tokens stored in cookies, including JWT access and refresh tokens.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- www.tenable.com/security/research/tra-2026-25nvdVendor Advisory
News mentions
0No linked articles in our index yet.