Arbitrary File Upload Vulnerability in Hubleys Dashboard by Hubleys

CVE-2026-67444

What is CVE-2026-67444?

The Hubleys Dashboard has a vulnerability that allows authenticated (non-admin) users to upload files with any extension, including harmful scripts. These files are served back with a Content-Type determined by the attacker's chosen extension, which can lead to executing malicious scripts. The issue arises due to the endpoint serving files through a custom response mechanism, bypassing the configured Content-Security-Policy, which would normally mitigate such risks. This vulnerability was addressed in version 0.5.2 of Hubleys Dashboard.

References