Dobase
Monthly
Stored DOM-based XSS in Dobase prior to 2026.06.03 allows any authenticated workspace member to persist an executable JavaScript payload in the public, unauthenticated shared-folder image gallery by crafting a malicious file name. The public-gallery Stimulus controller reads the filename from a data-name HTML attribute via el.dataset.name (which HTML-decodes it) and injects the raw value into innerHTML without sanitization, converting a server-side ERB-escaped attribute back into an executable sink. Critically, the application's Content-Security-Policy is deployed in report-only mode rather than enforcement, so inline onerror handlers execute freely against any unauthenticated visitor who opens the public share link. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored DOM-based XSS in Dobase prior to 2026.06.03 allows any authenticated workspace member to persist an executable JavaScript payload in the public, unauthenticated shared-folder image gallery by crafting a malicious file name. The public-gallery Stimulus controller reads the filename from a data-name HTML attribute via el.dataset.name (which HTML-decodes it) and injects the raw value into innerHTML without sanitization, converting a server-side ERB-escaped attribute back into an executable sink. Critically, the application's Content-Security-Policy is deployed in report-only mode rather than enforcement, so inline onerror handlers execute freely against any unauthenticated visitor who opens the public share link. No public exploit code or CISA KEV listing has been identified at time of analysis.