Stored Cross-Site Scripting Vulnerability in EdgeEver by Tianma If
CVE-2026-129172

5.1MEDIUM

Key Information:

Vendor

Tianma-if

Status
Edgeever
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129172?

EdgeEver versions prior to 2.13.0 contain a serious stored cross-site scripting vulnerability. This flaw exists in the backup restore endpoint, allowing authenticated users to upload a resource of type image with a text/html MIME type without proper validation. As a result, attackers can craft a malicious note and share a public link to victims. When victims open this link, their browsers execute the injected script, enabling the attacker to generate a non-expiring API token that provides unauthorized access to the victim's notes.

Affected Version(s)

EdgeEver 1.9.0 < 2.13.0

References

https://vul.yulun.ac.cn/20261028/edgeever/
third-party-advisory
https://github.com/tianma-if/edgeever/issues/701
issue-tracking
https://github.com/tianma-if/edgeever/commit/dc5a55a1c26d...
patch

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wu Yulun
.