GHSA-28p3-4q26-3xh2MediumCVSS 5.4
EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup...
🔗 CVE IDs covered (1)
📋 Description
EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoint PUT /api/v1/restores/json/resources/:id, which accepts a resource kind of image paired with a text/html MIME type without checking consistency. Authenticated members can share the note and send the public blob link to a victim, whose browser executes the script to mint a non-expiring API token granting read and write access to the victim's notes.
🔗 References (8)
- https://nvd.nist.gov/vuln/detail/CVE-2026-129172
- https://github.com/tianma-if/edgeever/issues/701
- https://github.com/tianma-if/edgeever/commit/dc5a55a1c26d6add0e28d95dc0b282c611692e34
- https://github.com/tianma-if/edgeever/blob/eeaab088f41d0417fbce2266f58ff4adde7f5d76/apps/api/src/backup-routes.ts#L487-L550
- https://github.com/tianma-if/edgeever/blob/eeaab088f41d0417fbce2266f58ff4adde7f5d76/apps/api/src/share-routes.ts#L77-L80
- https://vul.yulun.ac.cn/20261028/edgeever
- https://www.vulncheck.com/advisories/edgeever-1.9.0-before-2.13.0-stored-xss-via-backup-restore-and-public-shares
- https://github.com/advisories/GHSA-28p3-4q26-3xh2