EUVD-2026-52452
GHSA-2pjc-27f2-cwx3
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered stored XSS with no auth required but high complexity; scope changes to victim browser enabling session data access (C:L) alongside integrity impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stored cross-site scripting in OpenAkita's File Upload API (/api/upload) allows remote attackers to inject persistent malicious scripts by manipulating file-related arguments, affecting all versions through 1.27.12. The Notion-hosted proof-of-concept confirms this is a storage-type XSS, meaning the payload persists server-side and executes in victims' browsers upon subsequent access to the affected content. A public exploit exists and the vendor did not respond to responsible disclosure, leaving no official patch; exploitation is constrained by high attack complexity (AC:H) and required user interaction (UI:P), reflected in the low CVSS 4.0 score of 2.3.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant where malicious input is persisted server-side before being reflected to other users. The affected endpoint /api/upload in OpenAkita's File Upload API fails to adequately sanitize file-related arguments - likely filename, file metadata, or MIME type fields - before storing and later rendering them. The CPE string cpe:2.3:a:n/a:openakita:*:*:*:*:*:*:*:* with a vendor field of 'n/a' is characteristic of a community or open-source project without a formal vendor entity in NVD's vendor registry, suggesting limited security maintenance capacity. Stored XSS in file upload contexts typically exploits lax validation of filename extensions or content-type fields that are subsequently displayed in a file management UI without output encoding.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure. As an immediate compensating control, operators should implement a strict Content Security Policy (CSP) header on OpenAkita responses to block inline script execution, noting this may impact legitimate application functionality if the app relies on inline scripts. File upload validation should be hardened server-side to whitelist allowed MIME types and sanitize filenames by stripping or encoding special characters before storage; this requires application-level changes. Output encoding of all stored filenames and metadata in the file management UI would directly neutralize the XSS payload at render time. Restricting access to the /api/upload endpoint via authentication middleware or network-layer controls (reverse proxy ACLs) limits the unauthenticated upload attack surface. Reference the VulDB entry at https://vuldb.com/vuln/385609 and the POC at https://app.notion.com/p/OpenAkita-Storage-type-XSS-36b6b282520c80e790d4d95013f67e31 to understand the attack surface before applying mitigations.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today