CVE-2026-129140 in paicoding
Summary
by MITRE • 11/13/2026
paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability in image upload because ImageServiceImpl.validateStaticImg accepts SVG files, which are then served from the site origin when local storage is used. Authenticated attackers can upload script-bearing SVG images that execute when victims view them, stealing the non-HttpOnly f-session cookie to hijack accounts.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/13/2026
The vulnerability identified in paicoding versions 1.0.0 through 1.0.3 represents a critical stored cross-site scripting flaw rooted in insufficient input validation within the image upload functionality. Specifically, the ImageServiceImpl.validateStaticImg method fails to adequately restrict file types or sanitize content before processing uploaded images. This oversight allows attackers to bypass standard security controls by uploading Scalable Vector Graphics files that contain embedded JavaScript code. Unlike transient reflected XSS attacks where malicious payloads are delivered via URLs and require immediate user interaction with a crafted link, this stored variant persists on the server side. The vulnerability exploits the application's logic for serving static assets from its own origin when local storage mechanisms are utilized, thereby ensuring that any content served is treated as trusted by the victim's browser security model.
The operational impact of this flaw is severe due to the persistent nature of the attack vector and the high privilege level required for exploitation relative to typical web vulnerabilities. An authenticated attacker can upload a malicious SVG file containing script tags or event handlers such as onload attributes that trigger JavaScript execution upon rendering. When other users, including potentially privileged administrators, view these images within the application interface, their browsers execute the embedded scripts in the context of the paicoding domain. This environment allows the malicious code to access session cookies that are not marked with the HttpOnly flag. By stealing these non-HttpOnly f-session cookies, an attacker can hijack active user sessions without needing valid credentials or multi-factor authentication tokens associated with those accounts.
From a classification perspective, this vulnerability aligns closely with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and more specifically CWE-836 Use of Password Hash Instead of Password for Authentication when considering the session hijacking outcome. In terms of adversary tactics, it maps to MITRE ATT&CK technique T1059 Command and Control via Application Layer Protocol or potentially T1212 Exploitation for Credential Access depending on how the stolen data is exfiltrated. The attack chain involves initial access through authentication bypass or valid credentials followed by persistence via stored payload injection and finally credential theft leading to account takeover.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Developers should immediately update paicoding to a patched version that enforces strict allow-listing of image file types, ensuring only standard raster formats like JPEG or PNG are accepted while explicitly blocking SVG files unless they can be safely sanitized using robust libraries such as DOMPurify which strip executable content from XML-based graphics. Additionally implementing Content Security Policy headers with directives restricting script execution to trusted sources and marking session cookies with HttpOnly flags will significantly reduce the impact of any future XSS attempts even if input validation is bypassed. Regular security audits focusing on file upload handlers and static asset serving logic are recommended to prevent similar vulnerabilities in other components of the application infrastructure.