Stored Cross-Site Scripting in Paicoding by Itwanger

CVE-2026-129140

What is CVE-2026-129140?

Paicoding, versions 1.0.0 to 1.0.3, is vulnerable to a stored cross-site scripting (XSS) flaw due to improper handling of SVG files in the image upload feature. The vulnerability arises when the ImageServiceImpl component accepts SVG files that can contain malicious scripts. An authenticated attacker could upload an SVG file containing such scripts, which would execute when unsuspecting users view the affected images. This could lead to the theft of session cookies, allowing attackers to hijack user accounts. Immediate action is necessary to mitigate this risk by properly validating and sanitizing uploaded SVG content.

References