CVE-2026-18682 in OpenAkita
Summary
by MITRE • 08/04/2026
A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/04/2026
The security vulnerability identified in OpenAkita version 1.27.12 and earlier represents a critical cross site scripting flaw within the file upload functionality of the application's API. This vulnerability exists in the /api/upload endpoint of the File Upload API component, where improper input validation allows malicious actors to inject malicious scripts through file upload operations. The flaw specifically affects the File argument parameter, which when manipulated can execute arbitrary JavaScript code in the context of other users' browsers who access the uploaded content.
This vulnerability falls under the CWE-79 category of Cross Site Scripting, which is classified as a critical weakness in web applications that allows attackers to inject client-side scripts into web pages viewed by other users. The attack vector requires remote exploitation, meaning an attacker can trigger the vulnerability from outside the local network without requiring physical access or direct system interaction. The high complexity level associated with this attack indicates that successful exploitation requires significant technical expertise and resources, though the public availability of exploit code has lowered the barrier to implementation.
The operational impact of this vulnerability is severe as it allows attackers to execute malicious scripts in users' browsers, potentially enabling session hijacking, credential theft, data exfiltration, and other malicious activities. The fact that a public exploit exists means that this vulnerability can be immediately leveraged by threat actors without requiring advanced development skills. The lack of vendor response to early disclosure attempts is particularly concerning as it suggests either inadequate security monitoring or delayed remediation processes that leave users exposed to ongoing risk.
Organizations utilizing OpenAkita versions up to 1.27.12 should implement immediate mitigations including input validation and sanitization of file upload parameters, implementing Content Security Policy headers to restrict script execution, and deploying web application firewalls to detect and block malicious file uploads. The vulnerability also aligns with ATT&CK technique T1566 for initial access through spearphishing attachments and T1071 for application layer protocol usage. Additionally, organizations should consider implementing strict file type validation, size limitations, and secure file storage practices to prevent exploitation of similar upload vulnerabilities in other components of their web applications.