axeloz filesharing before 2.14.3 Stored XSS via Bundle Description Markdown Links

Advisories

axeloz filesharing before 2.14.3 Stored XSS via Bundle Description Markdown Links

Severity: medium
Date: 11/14/2026
Affecting: filesharing >= 0, < 2.14.3
CVE: CVE-2026-129430
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: 5.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
References: Patch Commit
Patch Commit (BundleResourceFiltered)
https://github.com/axeloz/filesharing/pull/90
Unsafe Str::markdown rendering of description
filesharing 2.14.3 Release Notes
https://github.com/axeloz/filesharing
Credit: Raqin Al-Asraar, axeloz
Description: Axeloz Filesharing before 2.14.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script by storing raw HTML or javascript: Markdown links in bundle descriptions. Recipients viewing the public bundle preview page execute the script via Alpine x-html, letting attackers steal the owner_token from localStorage and issue owner-scoped requests against victim bundles.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo