Stored Cross-Site Scripting in Axeloz Filesharing Software
CVE-2026-129430

5.1MEDIUM

Key Information:

Vendor

Axeloz

Status
Filesharing
Vendor
CVE Published:
14 November 2026

What is CVE-2026-129430?

The Axeloz Filesharing software prior to version 2.14.3 is susceptible to a stored cross-site scripting vulnerability. This flaw enables authenticated users to inject malicious scripts by embedding raw HTML or JavaScript links in markdown format within bundle descriptions. When recipients access the public bundle preview page, these injected scripts are executed through Alpine's x-html processing. Consequently, attackers can exploit this vulnerability to retrieve the owner_token stored in localStorage, facilitating unauthorized owner-scoped requests on victim bundles.

Affected Version(s)

filesharing 0 < 2.14.3

filesharing 2.14.3

References

https://github.com/axeloz/filesharing/commit/eebc80a77c0e...
patch
https://github.com/axeloz/filesharing/commit/366ee452aba6...
patch
https://github.com/axeloz/filesharing/pull/90
issue-trackingpatch

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Raqin Al-Asraar
axeloz
.