Medium severityNVD Advisory· Published May 11, 2026· Updated May 13, 2026

CVE-2026-7308

Description

An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0. This could allow the attacker to perform actions in the context of the victim's session.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Sonatype/Nexus Repositoryllm-create
Range: >=3.6.0, <3.92.0

Patches

Vulnerability mechanics

References

help.sonatype.com/en/sonatype-nexus-repository-3-92-0-release-notes.htmlnvd
support.sonatype.com/hc/en-us/articles/51592065985939nvd

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000