Cross-Site Scripting Vulnerability in Sonatype Nexus Repository

CVE-2026-7308

What is CVE-2026-7308?

An authenticated user with upload privileges on a hosted repository in Sonatype Nexus Repository can exploit a vulnerability that allows them to store malicious content. This malicious content can execute arbitrary JavaScript in the web browser of any user accessing the affected repository directory through the HTML index page. The vulnerability affects versions from 3.6.0 to just before 3.92.0, potentially allowing an attacker to perform actions within the session context of the victim, leading to sensitive data exposure or account compromise.

References