CVE-2026-111168 in LibreDesk
Summary
by MITRE • 10/15/2026
LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in LibreDesk versions prior to 2.9.0-rc.8 represents a significant security flaw within the media handling subsystem of the application. This issue is classified as a stored cross-site scripting (XSS) attack, which falls under the Common Weakness Enumeration category CWE-79 for Improper Neutralization of Input During Web Page Generation. The core technical deficiency lies in how the server processes and serves uploaded files, specifically SVG images that are submitted with malformed or non-standard Content-Type headers. When an authenticated agent uploads a file via the /api/v1/media endpoint, the system fails to strictly validate the MIME type against the actual content of the file or enforce strict sanitization rules for XML-based formats like SVGs. Instead, it relies on potentially unreliable client-supplied metadata or performs insufficient server-side validation, allowing attackers to bypass standard security controls by specifying a Content-Type such as image/svg+xml with an invalid parameter suffix like x.
The operational impact of this vulnerability is severe because the stored nature of the XSS means that malicious scripts are persisted in the application's storage rather than being executed solely within the context of a single request. When another user, including administrators or other agents, accesses the uploaded file through the GET /uploads/{uuid} endpoint, the server serves the SVG content inline without applying necessary security sandboxing mechanisms such as Content Security Policy restrictions or iframe sandbox attributes. This lack of isolation allows any JavaScript embedded within the malicious SVG to execute with full privileges in the context of the victim's session. Consequently, an attacker can perform actions on behalf of the user, steal sensitive cookies and session tokens, capture keystrokes, or redirect users to phishing sites, effectively compromising the confidentiality and integrity of the system for all viewers of the compromised media asset.
This vulnerability aligns with MITRE ATT&CK technique T1059.007, which covers JavaScript execution within web browsers, specifically in the context of stored XSS payloads delivered via file uploads. The attack vector requires authentication to upload files but does not require privilege escalation beyond that initial authenticated state, making it accessible to any user account with media upload permissions. To mitigate this risk, organizations must upgrade LibreDesk to version 2.9.0-rc.8 or later where the issue has been addressed. In the interim, administrators should implement strict file type validation on the server side using magic bytes rather than relying solely on Content-Type headers from client requests. Additionally, enforcing a robust Content Security Policy that restricts inline script execution and ensuring that media files are served with appropriate security headers such as X-Content-Type-Options: nosniff can significantly reduce the attack surface by preventing browsers from interpreting malicious content as executable scripts even if they are successfully uploaded.