Stored Cross-Site Scripting Vulnerability in LibreDesk by Abhinavxd

CVE-2026-111168

What is CVE-2026-111168?

LibreDesk prior to version 2.9.0-rc.8 contains a stored cross-site scripting vulnerability. This flaw enables authenticated users to upload SVG files with incorrect Content-Type parameters, specifically 'image/svg+xml; x'. The vulnerability can be exploited through the /api/v1/media endpoint, allowing the uploaded SVG to be served inline without the necessary security sandboxing. As a result, any scripts contained in the SVG can execute in the context of a session for any user or administrator viewing the media, potentially leading to account hijacking or session compromise.

References