What is the CVSS score of CVE-2026-52475?

CVE-2026-52475 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

aiflowy CVE-2026-52475

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-21 mitre

XSS Java N A

6.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-reachable upload endpoint with no auth required; victim interaction needed to trigger reflected/stored XSS; scope changes to browser context; no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:41 vuln.today

CVSS changed

Jul 22, 2026 - 18:22 NVD

6.1 (MEDIUM)

CVE Published

Jul 21, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file

AnalysisAI

Cross-site scripting (XSS) in aiflowy 2.1.2 and earlier allows unauthenticated remote attackers to inject malicious scripts via the UploadController.java file upload endpoint, which are then executed in victim users' browsers. The scope change in the CVSS vector (S:C) confirms the attack crosses the application's security boundary into the browser context, enabling session hijacking or credential theft. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.19% (9th percentile), indicating low current exploitation probability despite a publicly referenced writeup on GitHub.

Technical ContextAI

aiflowy is a Java-based web application (tagged Java/XSS) with a file upload handler implemented in UploadController.java. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input - likely a filename, file metadata, or file content rendered back to the browser - is not properly encoded before being inserted into the HTML response. The CVSS scope change (S:C) is consistent with stored or reflected XSS where script executes in the victim's browser security origin rather than the server's. The CPE string is listed as cpe:2.3:a:n/a:n/a:* indicating this product is not formally catalogued in the NVD CPE dictionary, suggesting it is a niche or emerging tool with limited vendor tracking.

RemediationAI

Upgrade aiflowy to a version above 2.1.2 if a patched release has been issued by the vendor - no confirmed fix version is available from the provided data, so operators should consult the aiflowy project repository directly for patch status. As a compensating control, restrict access to the file upload endpoint (UploadController.java) to authenticated and authorized users only, which converts this from a PR:N to a PR:L/PR:H attack, significantly raising the attacker's required foothold. Additionally, implement server-side output encoding for any filename, file metadata, or upload response content rendered in HTML responses, and configure a strict Content Security Policy (CSP) header to limit the impact of any injected scripts. If the upload feature is not required, disabling it eliminates the attack surface entirely. No side effects are anticipated from output encoding; CSP deployment may break legacy inline scripts if any are present in the application.