Stored Cross-Site Scripting in Omnispace Agora Project by Omnispace

CVE-2026-63147

What is CVE-2026-63147?

The Omnispace Agora Project prior to version 26.10.0 contains a vulnerability that allows authenticated users to exploit stored cross-site scripting. This occurs when attackers upload files using crafted names that include HTML or script markup. The vulnerability arises from the fact that the uploaded filenames are processed through the $_FILES array, bypassing typical input filtering mechanisms. As a result, malicious scripts can be stored and later executed when rendered to other users, posing a significant risk of unauthorized actions within their browsers.

References