Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy (CSP) or adequate Content-Type validation, leading to Stored Cross-Site Scripting (XSS).
References
| Link | Resource |
|---|---|
| https://gist.github.com/kazisabu/27f3e272f474005001a9ecd2c258dbea | Exploit Third Party Advisory |
Configurations
History
11 Feb 2026, 15:30
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:stefanprodan:podinfo:*:*:*:*:*:kubernetes:*:* | |
| First Time |
Stefanprodan podinfo
Stefanprodan |
|
| References | () https://gist.github.com/kazisabu/27f3e272f474005001a9ecd2c258dbea - Exploit, Third Party Advisory |
05 Feb 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
04 Feb 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| CWE | CWE-79 CWE-434 |
03 Feb 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-03 18:16
Updated : 2026-02-11 15:30
NVD link : CVE-2025-70849
Mitre link : CVE-2025-70849
CVE.ORG link : CVE-2025-70849
JSON object : View
Products Affected
stefanprodan
- podinfo