CVE-2026-129172 in EdgeEver
Summary
by MITRE • 11/13/2026
EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoint PUT /api/v1/restores/json/resources/:id, which accepts a resource kind of image paired with a text/html MIME type without checking consistency. Authenticated members can share the note and send the public blob link to a victim, whose browser executes the script to mint a non-expiring API token granting read and write access to the victim's notes.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/13/2026
The vulnerability identified in EdgeEver versions prior to 2.13.0 represents a critical stored cross-site scripting flaw located within the backup restore functionality of the application. Specifically, this issue resides in the PUT /api/v1/restores/json/resources/:id endpoint, which is designed to process resource restoration requests. The core technical failure stems from an inconsistency check deficiency where the system accepts a request specifying a resource kind of image while simultaneously providing a text/html MIME type. In a properly secured application, such a mismatch between the declared content type and the actual data structure should trigger validation errors or sanitization protocols that prevent malicious payloads from being stored in the database. However, EdgeEver fails to enforce this consistency check, allowing an attacker to inject arbitrary HTML and JavaScript code into what is ostensibly an image resource field. This lack of input validation permits the storage of executable scripts directly within the application's persistent data store, setting the stage for a severe security breach that affects all users who interact with the compromised data.
The operational impact of this vulnerability is significant due to its stored nature and the specific capabilities granted by the resulting script execution. An authenticated user can exploit this flaw by crafting a malicious backup file or request payload containing JavaScript code disguised as an image resource. Once this payload is submitted, it becomes permanently stored on the server associated with that specific restore operation ID. The attacker then shares the public blob link of this compromised note with a victim through social engineering tactics such as phishing emails or direct messages. When the victim accesses the shared link in their web browser, the malicious script executes automatically within the context of the EdgeEver application domain. This execution is particularly dangerous because it occurs while the victim is authenticated, allowing the script to leverage the user's active session tokens and permissions without requiring further interaction beyond viewing the page.
The consequences of this successful exploitation are severe, as demonstrated by the ability of the attacker to mint a non-expiring API token with read and write access to the victim's notes. This outcome effectively grants the attacker persistent administrative-level control over the victim's data for that specific application instance. Unlike session-based attacks where tokens may expire or require re-authentication, a non-expiring token allows the attacker to maintain long-term unauthorized access even if the user changes their password or logs out and back in later. The attacker can subsequently exfiltrate sensitive information stored within the notes, modify existing content to spread further malware or misinformation, or use the compromised account as a foothold for lateral movement within any integrated systems that trust EdgeEver's API authentication mechanisms. This level of persistence transforms a standard cross-site scripting vulnerability into a critical data breach vector with lasting implications for user privacy and organizational security posture.
From a classification perspective, this vulnerability aligns closely with CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. More specifically, it falls under the subcategory of Stored XSS where malicious scripts are permanently stored on target servers. The attack vector also maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, particularly in how JavaScript is used to execute arbitrary commands within the browser environment. Furthermore, the exploitation method relates to T1556, Modification of Authentication Processes, as the attacker manipulates the authentication flow by forging API tokens using stolen session context. Understanding these mappings helps security teams contextualize the risk and prioritize remediation efforts based on established industry standards for web application security flaws.
Mitigation strategies must focus primarily on immediate patching to version 2.13.0 or later, where this consistency check has presumably been implemented by the vendor. In addition to updating software, organizations should implement strict Content Security Policy headers that restrict script execution from unauthorized sources and prevent inline scripts unless absolutely necessary for application functionality. Input validation must be enforced at both the client-side interface level and the server-side API endpoint to ensure that MIME types match expected resource kinds before any data is persisted to storage. Additionally, implementing robust output encoding when rendering user-supplied content in HTML contexts can provide a secondary layer of defense against script injection. Security teams should also monitor for unusual API token generation patterns or access from unfamiliar IP addresses as an indicator of compromise following the vulnerability's disclosure. Regular security audits and penetration testing focusing on file upload and restoration endpoints are recommended to identify similar inconsistencies before they can be exploited in production environments.