Agora Project EUVD-2026-100473

Exploitation requires an authenticated account on the Agora Project instance with the ability to submit a poll-response attachment, and the attacker must craft a filename containing HTML/script markup that evades the paramFilter sanitization applied to $_FILES. The payload only fires when another user subsequently views a page that renders the stored filename, such as the dashboard controller (CtrlDashboard), so victim interaction (viewing the page) is mandatory. Limiting factors: attacker must already be a legitimate (if low-privileged) user, impact is confined to the victim's browser rather than the server, and the deployment must host multiple users for the stored payload to reach a meaningful victim; affects versions before 26.10.0 only.

This is a medium-severity stored XSS (CVSS 4.0 base 5.1, CWE-79) that should be treated as a moderate, not urgent, priority. The CVSS 4.0 vector tells a consistent and self-limiting story: network attack vector (AV:N) and low complexity (AC:L), but exploitation requires authenticated access (PR:L - the attacker must be a legitimate logged-in user able to submit a poll-response attachment) and passive victim interaction (UI:P - a user must view the affected dashboard page). Impact is confined to the victim's browser session: there is no direct impact on the vulnerable system itself (VC:N/VI:N/VA:N) and only low confidentiality and integrity impact on the subsequent system (SC:L/SI:L), consistent with script execution in another user's browser. No active-exploitation or exploit-availability signals are present: this CVE is NOT in CISA KEV, no POC was provided in the intelligence, and no EPSS score was supplied, so there is no evidence of widespread or opportunistic exploitation. The signals do not conflict - a comparatively low CVSS score, no KEV, and no known POC all point the same direction: a real but bounded issue most relevant to multi-user Agora Project deployments where untrusted or semi-trusted users can upload content. EPSS was not provided and cannot be used to refine likelihood.

An authenticated low-privileged user of an Agora Project collaboration instance uploads a poll-response attachment whose filename contains HTML/script markup crafted to bypass the paramFilter sanitization applied to $_FILES. The malicious filename is stored and later rendered by components such as the dashboard controller (CtrlDashboard), so that when another user - potentially an administrator - views the affected page, the script executes in their browser, enabling session theft or actions in their context. No public exploit code was identified in the provided intelligence.