Insecure Attachment Handling in NocoDB by NocoDB Team
CVE-2026-53929

5.1MEDIUM

Key Information:

Vendor

Nocodb

Status
Nocodb
Vendor
CVE Published:
23 June 2026

What is CVE-2026-53929?

Prior to version 2026.05.1, NocoDB's handling of file attachments allowed authenticated users to upload .html or .svg files, which the system rendered inline directly from the server, instead of prompting a download. This was due to a mismatch in how response headers were processed, leading to potential security risks. The vulnerability has been addressed in version 2026.05.1, ensuring that all attachments are correctly served to prevent inline rendering.

Affected Version(s)

nocodb < 2026.05.1

References

https://github.com/nocodb/nocodb/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.