PandaWiki CVE-2026-120428

Two concrete prerequisites must both be met. First, the attacker reaches the unauthenticated endpoint /share/v1/common/file/upload and uploads an HTML file bearing an image extension (PR:N - no credentials needed for this step). Second, an administrator must be lured into opening /static-file/<key>?a=.pdf, where appending the ?a=.pdf query string defeats the nginx attachment/Content-Disposition header and causes the HTML to be served inline and executed. Limiting factors: exploitation requires active administrator interaction (UI:A) - it does not fire automatically; the targeted admin must hold a valid panda_wiki_token session for the JWT theft to yield takeover; and the deployment must run an affected version (3.65.0 through 3.87.5) behind the described nginx static-file serving configuration.

This is a medium-severity stored XSS (CVSS 4.0 base 5.1, CWE-79) whose real-world risk is moderate and conditional rather than critical. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms the upload step is network-reachable and unauthenticated with low complexity, but UI:A means exploitation cannot complete without an administrator actively opening the attacker's crafted link - the decisive limiting factor. Impact is constrained to the subsequent system (VC:N/VI:N/VA:N on the vulnerable component, SC:L/SI:L on the admin's authenticated session), consistent with JWT theft leading to session takeover rather than direct server compromise. Exploitation signals are mixed and mostly soft: a public PoC reference exists but is not verified as working exploit code; there is no CISA KEV listing (not confirmed actively exploited) and no EPSS score was provided, so widespread automated exploitation cannot be inferred. The vuln.today decision label is 'this_month', not act_now or emergency, matching a patch-on-normal-cadence posture. The CVSS vector and the description are consistent (network-facing unauthenticated upload plus required admin interaction), so no vector/description conflict is present; the main missing signals are EPSS probability and an independently confirmed fixed version.

An unauthenticated attacker uploads a malicious HTML file disguised with an image extension through /share/v1/common/file/upload, then sends an administrator a link to /static-file/<key>?a=.pdf. Because the ?a=.pdf query string bypasses the nginx attachment (Content-Disposition) header, the HTML is served inline and executes in the admin's browser when they open it, exfiltrating the panda_wiki_token JWT for session takeover. A public PoC reference exists but is not verified as working exploit code, and success depends on active administrator interaction (UI:A).