Stored Cross-Site Scripting Vulnerability in Pandora's PDF Download Functionality

CVE-2026-75529

What is CVE-2026-75529?

Pandora is affected by a stored cross-site scripting vulnerability in its PDF download feature. The vulnerable endpoint allows an attacker to manipulate the file's content type by crafting a malicious PDF or polyglot file. When a user initiates a PDF download, the application does not enforce the correct MIME type, resulting in the potential execution of unsafe scripts in the user’s browser. This poses a risk of unauthorized access to application data or actions within Pandora, especially if the user is logged into the platform. A patch has been implemented to mitigate this risk by enforcing the proper content type and file handling during downloads.

References