Agora Project CVE-2026-63147

Requires a valid authenticated account on the Agora Project instance (PR:L) with permission to upload files, and a crafted filename containing HTML/SVG markup such as an SVG onload payload; the payload survives because uploaded-file names arrive through $_FILES and are not processed by the paramFilter that sanitizes $_GET/$_POST input. Exploitation is limited by the authentication requirement and by the need for another user to subsequently view/render the stored filename (UI:P), and only affects deployments on versions before 26.10.0.

Signals align on a genuine but modest priority. The CVSS 4.0 base score is 5.1 (medium): AV:N/AC:L/AT:N give easy remote reachability, but PR:L requires an authenticated account and UI:P requires a victim to passively render the stored filename, which meaningfully gates exploitation. Impact is confined to the subsequent system (victim browser) as SC:L/SI:L with no impact to the vulnerable application itself (VC/VI/VA all N) - consistent with stored XSS rather than server compromise. No EPSS score was provided, the CVE is not on CISA KEV, and no public exploit was identified, so there is no evidence of active or at-scale exploitation; this is a low-to-moderate, authenticated-abuse-class issue rather than an internet-wide emergency. The main caveat: EPSS is absent, so probabilistic exploitation likelihood cannot be quantified from the input.

A low-privileged but authenticated Agora Project user uploads a file whose name embeds an SVG onload (or similar HTML/script) payload. Because uploaded filenames arrive via $_FILES and bypass the paramFilter sanitization applied to $_GET/$_POST, the malicious name is stored unsanitized and later rendered to other users, executing script in their browsers. No public exploit code was identified at time of analysis, though the technique is described in the VulnCheck advisory.