CVE-2026-107801 in Jivejdon
Summary
by MITRE • 10/09/2026
Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments with an attacker-supplied Content-Type. Attackers can upload a file declared as text/html, which UploadShowAction serves inline, and share its link to run JavaScript on the application's origin for viewing users.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The identified vulnerability in Jivejdon versions up to 5.0 represents a classic stored cross-site scripting (XSS) flaw that exploits improper validation of file metadata during upload operations. This security defect allows authenticated attackers to inject malicious JavaScript payloads into the application by manipulating the Content-Type header associated with uploaded attachments. The core technical failure lies in the server-side processing logic, specifically within the UploadShowAction component, which fails to strictly enforce or sanitize the MIME type declarations provided by the client. When a user uploads a file and explicitly sets its content type to text/html, the application accepts this declaration without verifying that the actual file contents match the stated type or applying appropriate output encoding when rendering the attachment link. This lack of validation creates a persistent vector for code injection because the malicious payload is stored on the server rather than being transient in a URL parameter or request body.
The operational impact of this vulnerability is significant due to its stored nature and the requirement for authentication, which limits the attack surface but increases the severity among targeted user groups. Once an authenticated attacker uploads a file with a manipulated Content-Type header pointing to text/html, the application serves this content inline when other users access the attachment link. Because the browser interprets the served content as HTML based on the declared type, any embedded JavaScript executes within the security context of the Jivejdon origin. This allows the attacker to perform actions such as session hijacking by stealing cookies or authentication tokens, performing unauthorized state-changing requests on behalf of victims, defacing web pages, or redirecting users to phishing sites. The persistence of this payload means that every user who views the shared link is potentially compromised until the malicious file is manually removed from the system.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. Specifically, it falls under the sub-category where untrusted data is used in HTML context without proper encoding or validation. In terms of offensive security frameworks like MITRE ATT&CK, this technique maps to T1059 Command and Control via Application Layer Protocol, specifically leveraging web protocols for delivery, and can be further categorized under T1204 User Execution if the attack relies on social engineering to get users to click links. The vulnerability also touches upon CWE-601 URL Redirection to Untrusted Site which is often a secondary effect of XSS attacks aimed at credential harvesting.
Mitigation strategies must address both input validation and output encoding mechanisms within the application architecture. Developers should implement strict allow-listing for file types, ensuring that only expected binary or text formats are accepted while explicitly rejecting HTML-based content types regardless of what the client claims. Additionally, implementing Content Security Policy headers can help mitigate the impact by restricting script execution sources. On the server side, it is critical to validate not just the extension but also perform magic number checks on file contents to ensure they match their declared MIME type. Furthermore, applying context-aware output encoding when rendering attachment links in HTML responses ensures that any special characters are escaped before being sent to the browser, preventing interpretation as executable code even if malicious content somehow bypasses upload filters. Regular security audits and penetration testing focusing on file upload functionalities are essential to detect such misconfigurations early in the development lifecycle.