Cross-Site Scripting Vulnerability in YouMind Portal's Avatar Update Endpoint
CVE-2026-96535

5.1MEDIUM

Key Information:

Vendor

Youmind

Status
Youmind Web Application
Vendor
CVE Published:
13 October 2026

What is CVE-2026-96535?

A Cross-Site Scripting vulnerability exists in the YouMind portal specifically within the avatar update functionality. This flaw is exploited when users upload profile pictures through arbitrary URLs, revealing a significant lack of sanitization and validation for SVG content. When an SVG image containing embedded JavaScript is uploaded, the CDN serves it with the Content-Type header as image/svg+xml, allowing the script to execute within the context of the CDN’s domain, potentially compromising user security.

Affected Version(s)

YouMind web application 0 < 13/10/2026

References

https://www.incibe.es/en/incibe-cert/notices/aviso/cross-...

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Miguel Jiménez Cámara
.