Stored Cross-Site Scripting Vulnerability in Quark Drive by Cp0204

CVE-2026-45228

What is CVE-2026-45228?

Quark Drive prior to version 0.8.5 is susceptible to a stored cross-site scripting vulnerability that affects the System Configuration page. This vulnerability allows authenticated attackers to inject malicious HTML or JavaScript payloads into the push_config key names using Vue.js’s v-html directive, which does not properly escape such inputs. The injected code is stored on disk and executed in the browsers of all users accessing the System Configuration tab, creating opportunities for session cookie theft and enabling unauthorized actions that can compromise user accounts.

References