CVE-2026-108055 in ALO Suite
Summary
by MITRE • 11/03/2026
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:
CVE-2026-108055: Nombre in ‘/Inmuebles/Create’;
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified under CVE-2026-108055 represents a critical stored Cross-Site Scripting flaw within the Alosuite software suite, specifically targeting the delivery note and property management functionality. This security defect is rooted in insufficient input validation and sanitization mechanisms applied to the Nombre field during the creation of new records at the /Inmuebles/Create endpoint. When an authenticated user submits data containing malicious JavaScript payloads into this specific parameter, the application fails to properly encode or escape these inputs before storing them in the backend database. Consequently, when other authorized users subsequently view or interact with the affected property records, the browser interprets the stored script as executable code rather than static content. This behavior allows an attacker to inject arbitrary client-side scripts that persist on the server side, ensuring that every user accessing the compromised record is exposed to the malicious payload without requiring any additional interaction beyond viewing the page.
From a technical perspective, this vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as a primary category for cross-site scripting attacks. The exploitation vector relies on the application's failure to implement robust output encoding or context-aware sanitization strategies when rendering user-supplied data in an HTML context. Because the payload is stored server-side rather than being passed via URL parameters or temporary session variables, it achieves persistence across multiple sessions and users. This characteristic distinguishes stored XSS from reflected variants, as the impact is not limited to a single interaction but extends to all subsequent accesses of the tainted record. The attacker must possess valid authentication credentials to access the /Inmuebles/Create endpoint, which limits the attack surface to internal or compromised user accounts rather than anonymous external actors.
The operational impact of this vulnerability is significant due to its potential for session hijacking and data manipulation within the context of the victim’s active browser session. Once executed, the malicious JavaScript can perform a variety of actions that compromise confidentiality, integrity, and availability. These include stealing sensitive cookies or authentication tokens, which could allow an attacker to impersonate legitimate users and gain unauthorized access to their accounts. Additionally, the script can alter the displayed content on the page, potentially displaying misleading information or phishing interfaces designed to trick users into revealing further credentials. In enterprise environments using Alosuite for property management, such manipulation could lead to financial fraud if delivery notes or transaction records are altered visually during review processes. The ability to execute code in the context of other users' sessions effectively bypasses same-origin policy protections, granting the attacker broad access to application functionality and sensitive data accessible by those victims.
Mitigation strategies for this vulnerability must focus on implementing defense-in-depth measures at both the input and output layers. Developers should enforce strict server-side validation that rejects any non-alphanumeric characters or specific script-related keywords in the Nombre field unless they are explicitly required and safely encoded. More importantly, all user-supplied data rendered in HTML contexts must be properly escaped using context-aware encoding techniques to ensure that special characters such as angle brackets, quotes, and ampersands are converted into their safe entity equivalents before being sent to the client browser. Implementing a Content Security Policy (CSP) header can also mitigate the impact by restricting the sources from which scripts can be loaded or executed, thereby preventing inline script execution even if injection occurs. Regular security code reviews and automated static application security testing should be integrated into the development lifecycle to detect such sanitization failures early. Furthermore, limiting the privileges of accounts that have access to create property records can reduce the risk of exploitation by minimizing the number of potential attackers who can inject persistent payloads.