CVE-2026-108725 in core
Summary
by MITRE • 10/11/2026
Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via POST /uploads without type restrictions. Attackers can send the public GET /uploads/{path} URL to a signed-in victim, executing script in the application origin with the victim's access_token cookie, including administrators.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified within Cheshire Cat AI core versions up to 2.0.23 represents a significant security flaw rooted in inadequate input validation and file type enforcement mechanisms within its uploads plugin. This specific weakness is classified as a Stored Cross-Site Scripting (XSS) attack, which falls under the Common Weakness Enumeration category CWE-79: Improper Neutralization of Input During Web Page Generation. The core issue lies in the application's handling of HTTP POST requests directed at the /uploads endpoint. Instead of enforcing strict MIME type checks or validating file extensions against a whitelist of safe formats such as images, documents, or archives, the system accepts HTML files without restriction. This lack of sanitization allows an authenticated user to bypass standard security controls by uploading malicious content that is subsequently stored on the server and served dynamically when accessed.
The operational impact of this vulnerability is severe due to its persistent nature and the high privilege level often associated with administrative accounts in AI core platforms. Once a victim, particularly one with elevated privileges such as an administrator, accesses the public GET /uploads/{path} URL containing the malicious HTML payload, the browser executes the embedded script within the context of the application's origin. This execution environment grants the attacker access to sensitive cookies, including the critical access_token cookie used for session management and authentication. Consequently, this leads to a complete compromise of user sessions, enabling unauthorized actions such as data exfiltration, privilege escalation, or further exploitation of connected systems. The attack vector aligns with MITRE ATT&CK technique T1059.007: JavaScript, specifically illustrating how client-side scripts can be weaponized through stored vectors to hijack authenticated sessions.
Mitigation strategies must focus on implementing robust server-side validation and output encoding practices. Developers should enforce strict file type restrictions by validating both the MIME type and file extension against a predefined whitelist of safe formats before saving any uploaded content. Additionally, setting appropriate Content-Disposition headers with values like attachment or inline can help browsers handle files safely without executing embedded scripts. Implementing a Content Security Policy (CSP) is also recommended to restrict the sources from which scripts can be loaded and executed, thereby mitigating the impact even if an XSS vector is introduced. Regular security audits and penetration testing of upload functionalities are essential to ensure that such input validation gaps do not persist in production environments.