Cheshire Cat AI CVE-2026-108725

Requires (1) a valid authenticated account on the Cheshire Cat AI instance with permission to call POST /uploads (PR:L - typically any signed-in user, not just admins), since the uploads scaffold plugin accepts files without MIME/extension type restrictions; (2) the uploaded file being served back via the public GET /uploads/{path} endpoint in the application's own origin; and (3) a victim who is signed in and who opens the attacker-supplied link (UI:P passive interaction). Exploitation is further enabled by the access_token being stored in a cookie reachable from JavaScript in the page origin. Limiting factors: no unauthenticated path (an account is mandatory), the victim must click the link, and impact scales with the victim's role - stealing an administrator's token requires luring that specific admin.

This is a genuine but moderate-severity issue, not a top-priority emergency. The only CVSS vector provided is CVSS 4.0 (5.1, Medium): AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N - network-reachable and low-complexity, but requiring an authenticated low-privilege account (PR:L) AND passive victim interaction (UI:P, i.e. the victim must open the attacker-supplied link). No CVSS 3.1 vector, EPSS score, KEV entry, or SSVC decision point was supplied in the input, so exploitation-probability and automatability signals cannot be weighed - treat the absence of an EPSS/KEV signal as missing data, not as evidence of low risk. There is no KEV listing, so this is not confirmed actively exploited. A detailed third-party technical writeup (hackmd) and a direct link to the vulnerable source lines exist, which substantially lowers the barrier to building a working exploit, but no packaged public exploit code is explicitly flagged in the input. Net: the stored-XSS primitive is real and the privilege escalation path (victim admin's access_token cookie reachable from script) is meaningful, but the twin requirements of a valid account and victim click, combined with a niche product footprint, keep real-world mass-exploitation risk low-to-moderate rather than critical.

An attacker with any low-privilege authenticated account uploads a malicious HTML file through POST /uploads (which enforces no type restriction), then sends the resulting public GET /uploads/{path} link to a signed-in victim - ideally an administrator. When the victim opens the link in the application origin, the embedded script runs with access to the victim's access_token cookie, letting the attacker hijack the session, including admin sessions. A public technical writeup documents the full reproduction path, so a working exploit is low-effort to reconstruct even though no packaged exploit is flagged.