CVE-2026-26272

{"id": "CVE-2026-26272", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26272", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T16:44:58.799912Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sysadminsmedia", "product": "homebox", "versions": [{"status": "affected", "version": "< 0.24.0-rc.1"}]}]}], "published": "2026-03-03T23:15:55.050", "references": [{"url": "https://github.com/sysadminsmedia/homebox/commit/51bd04e5f4656b306a296745ddd854d45aa3b892", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-55fv-9q6q-vpcr", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, a stored cross-site scripting (XSS) vulnerability exists in the item attachment upload functionality. The application does not properly validate or restrict uploaded file types, allowing an authenticated user to upload malicious HTML or SVG files containing executable JavaScript (also, potentially other formats that render scripts). Uploaded attachments are accessible via direct links. When a user accesses such a file in their browser, the embedded JavaScript executes in the context of the application's origin. This vulnerability is fixed in 0.24.0-rc.1."}, {"lang": "es", "value": "HomeBox es un sistema de inventario y organizaci\u00f3n del hogar. Antes de la versi\u00f3n 0.24.0-rc.1, existe una vulnerabilidad de cross-site scripting (XSS) almacenado en la funcionalidad de carga de archivos adjuntos de elementos. La aplicaci\u00f3n no valida ni restringe adecuadamente los tipos de archivos cargados, permitiendo a un usuario autenticado cargar archivos HTML o SVG maliciosos que contienen JavaScript ejecutable (tambi\u00e9n, potencialmente otros formatos que renderizan scripts). Los archivos adjuntos cargados son accesibles a trav\u00e9s de enlaces directos. Cuando un usuario accede a dicho archivo en su navegador, el JavaScript incrustado se ejecuta en el contexto del origen de la aplicaci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.24.0-rc.1."}], "lastModified": "2026-06-17T10:26:01.377", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sysadminsmedia:homebox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16FA5C78-4497-4434-802B-AAA83C1BF0A8", "versionEndIncluding": "0.23.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}