Stored Cross-Site Scripting in Omnispace Agora Project Affects User Security

CVE-2026-63148

What is CVE-2026-63148?

The Omnispace Agora Project prior to version 26.10.0 is vulnerable to a stored cross-site scripting (XSS) attack. This flaw allows authenticated attackers to inject malicious HTML or script content via poll-response attachments containing deceptive filenames. The vulnerability circumvents sanitization measures that typically provide security against such exploits. When a crafted filename is uploaded, it can be saved and subsequently rendered in various components of the platform, such as the dashboard controller. This process can lead to the execution of arbitrary scripts in the browsers of users who access the affected dashboard page, compromising user data and privacy.

References