Stored Cross-Site Scripting in Quay by Red Hat
CVE-2026-11569

5.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Quay 3
Vendor
CVE Published:
8 June 2026

What is CVE-2026-11569?

A vulnerability exists in Quay's filedrop endpoint, which does not validate MIME types. This flaw allows authenticated users with repository write access to upload malicious SVG files containing JavaScript. These files are subsequently stored and served inline via the Content Delivery Network (CDN), resulting in stored cross-site scripting when unsuspecting users access the archive URL. This poses serious security risks, as attackers can exploit the vulnerability to execute unauthorized scripts in user sessions.

References

https://access.redhat.com/security/cve/CVE-2026-11569
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2486194
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Toni Gornals (Red Hat Product Security).
.