CVE-2026-120428 in PandaWiki
Summary
by MITRE • 11/02/2026
PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda_wiki_token JWT for session takeover.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in PandaWiki versions 3.65.0 through 3.87.5 represents a critical stored cross-site scripting flaw that fundamentally compromises the integrity of user sessions and administrative functions within the application. This security defect stems from insufficient input validation on the file upload endpoint located at /share/v1/common/file/upload, which permits unauthenticated users to submit files with arbitrary content types provided they possess extensions commonly associated with images or documents. By exploiting this lack of strict type checking, an attacker can bypass standard MIME-type verification mechanisms and inject malicious HTML payloads disguised as legitimate image files into the system's storage infrastructure.
The operational impact of this vulnerability is severe due to its stored nature, meaning the malicious payload persists on the server rather than being executed solely within a single user session context. Once uploaded, these crafted files can be accessed via the static file serving mechanism at /static-file/<key>. The core technical flaw lies in how the underlying nginx web server handles content disposition headers for these specific file types. By appending query parameters such as ?a=.pdf to the URL path, an attacker can manipulate the Content-Disposition header behavior, effectively neutralizing the attachment directive that would normally force a download dialog. Instead of prompting the user to save the file, the browser is instructed to render the content inline within the current window context.
This manipulation allows the embedded HTML payload to execute directly in the victim's browser environment with full access to cookies and local storage associated with the PandaWiki domain. When an administrator or any authenticated user views a compromised page that references this malicious asset, their session token, specifically the panda_wiki_token JWT, is exfiltrated by the injected script. This leads to complete session hijacking, granting the attacker the same privileges as the victim without requiring password authentication or multi-factor verification steps. The ability to steal JSON Web Tokens via stored XSS bypasses traditional network-level security controls and exploits the trust relationship between the browser and the application server.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). Specifically, it falls under Stored XSS where malicious scripts are permanently stored within target servers such as databases or message boards. In terms of the MITRE ATT&CK framework, this attack vector corresponds to T1059 Command and Control via Application Layer Protocol combined with T1534 Internal Spearphishing if used against internal users, but more accurately maps to T1208 Exploitation for Credential Access through browser-based token theft. The exploitation chain relies on social engineering elements where the attacker must lure a privileged user to access the compromised static file endpoint.
Mitigation strategies should prioritize immediate patching of PandaWiki to version 3.87.6 or later, which addresses these input validation and header handling deficiencies. In the interim, administrators can implement web application firewall rules that detect and block attempts to serve HTML content with inline disposition headers from upload directories. Additionally enforcing strict Content-Type checking on both client-side uploads and server-side static file serving ensures that only expected MIME types are rendered by browsers. Restricting access to administrative functions and monitoring for unusual JWT usage patterns can also help in detecting potential session hijacking activities resulting from this vulnerability.