EUVD-2026-60159
GHSA-wpg4-f3mj-hxh3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered DOM XSS with low-privilege requirement and mandatory victim interaction; scope changes to victim's browser session, yielding limited confidentiality and integrity impact.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
2DescriptionCVE.org
OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting (XSS) attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where a file can be attached and prepared for upload to the server.
This issue was fixed in OutSystems Service Center version 11.41.2
AnalysisAI
DOM-based Cross-Site Scripting in OutSystems Service Center (all versions before 11.41.2) allows a low-privileged authenticated user to inject malicious JavaScript by uploading a file with a crafted filename, which executes in the browser context of other users - typically higher-privileged administrators - who subsequently view the rendered filename. The flaw affects every file attachment location within Service Center. OutSystems has released a vendor patch in version 11.41.2; no public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
OutSystems Service Center is the central administrative console for OutSystems low-code application environments, used by platform operators and administrators to manage applications, deployments, and system health. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: client-side JavaScript dynamically inserts unsanitized filename data into the DOM without encoding, enabling script injection at the point of rendering rather than at upload time - the defining characteristic of DOM-based XSS as distinct from reflected or stored variants. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A) confirms the attack is network-delivered with low complexity and no special attack requirements, but depends on active user interaction from a victim. The subsequent-system impact metrics (SC:L/SI:L/SA:N) indicate the injected payload affects the victim's browser session rather than server-side resources. Affected versions are identified in ENISA EUVD-2026-60159 as Service Center 0 through all releases prior to 11.41.2.
RemediationAI
Upgrade OutSystems Service Center to version 11.41.2 or later, which contains the vendor-confirmed fix for this vulnerability. The patched release is available through the OutSystems downloads portal (https://www.outsystems.com/downloads/ScreenDetails?ReleaseId=22953&MajorVersion=11&ComponentName=LifeTime), and the security advisory is at https://success.outsystems.com/support/security/vulnerabilities/vulnerability_rpm_6669/. As a compensating control prior to patching, restrict file upload capabilities within Service Center to the minimum set of trusted users who genuinely require it - this reduces attacker opportunity but does not eliminate the flaw, as any authorized uploader can exploit it. Additionally, administrators should audit recent file upload logs for filenames containing JavaScript syntax (angle brackets, onerror handlers, script keywords). These controls reduce exposure but carry the operational trade-off of limiting legitimate file management workflows; patching remains the only definitive fix.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today