CVE-2026-124435
Summary
by MITRE • 11/08/2026
OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with write:admin permissions to upload HTML or SVG files containing JavaScript via the Manager configuration file upload endpoint. Attackers can lure victims to the unauthenticated image retrieval endpoint, which serves files as text/html or image/svg+xml, executing scripts within the application's origin.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/08/2026
The vulnerability identified in OpenRemote versions prior to 1.32.2 represents a critical security flaw classified under CWE-79, commonly known as Stored Cross-Site Scripting. This specific implementation of XSS differs from reflected variants because the malicious payload is persistently stored on the target server rather than being injected via URL parameters or request headers during a single session. The root cause lies in insufficient input validation and sanitization mechanisms within the Manager configuration file upload endpoint, which fails to adequately filter out executable script content when processing uploaded HTML or SVG files. This architectural oversight allows an attacker with authenticated write:admin privileges to inject malicious JavaScript code directly into the application's data store by uploading a specially crafted media file that contains embedded scripts rather than standard image markup.
The operational impact of this vulnerability is significant due to the privilege level required for exploitation and the persistence of the attack vector. An adversary must first authenticate with administrative write permissions, which limits the pool of potential attackers but increases the severity if such credentials are compromised through phishing or credential stuffing attacks. Once authenticated, the attacker uploads a malicious SVG file containing JavaScript code disguised as valid image data. The critical escalation occurs when other users access the unauthenticated image retrieval endpoint to view these files. Because this endpoint serves content with MIME types of text/html or image/svg+xml without enforcing strict Content Security Policies or stripping executable scripts, the browser interprets and executes the injected JavaScript within the context of the OpenRemote application's origin. This effectively bypasses same-origin policy protections, allowing the script to access cookies, session tokens, local storage, and perform actions on behalf of the victim user with full administrative privileges.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability facilitates techniques associated with Initial Access via Valid Accounts and Execution through Browser Scripting. The persistence aspect means that every subsequent view of the compromised image triggers the payload, creating a high-impact attack surface where any authenticated user interacting with the dashboard or media library becomes a potential victim without needing to click a malicious link externally. This can lead to complete compromise of the OpenRemote instance, including unauthorized control over IoT devices managed by the platform, exfiltration of sensitive configuration data, and lateral movement within the internal network if the application has broader system integrations.
Mitigation strategies must prioritize immediate patching to version 1.32.2 or later, where these input validation checks have been hardened. In environments where upgrading is not immediately feasible, administrators should implement strict Content Security Policy headers that restrict script execution from media endpoints and disable SVG scripting capabilities by setting the content type to image/svg+xml with appropriate security attributes if supported. Additionally, deploying a Web Application Firewall rule set capable of detecting encoded JavaScript patterns in uploaded files can provide an additional layer of defense against exploitation attempts targeting this specific upload endpoint before it reaches the application logic.