CVE-2026-40126 in Service Center
Summary
by MITRE • 08/17/2026
OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting (XSS) attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where a file can be attached and prepared for upload to the server.
This issue was fixed in OutSystems Service Center version 11.41.2
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The identified vulnerability represents a classic instance of DOM-based Cross-Site Scripting within the OutSystems Service Center application environment. This specific flaw arises from improper handling of user-supplied input, specifically filenames associated with file attachments during the upload preparation phase. In this architecture, client-side scripts process or display metadata related to files before they are transmitted to the server for storage. When a malicious actor uploads a file where the filename itself contains executable JavaScript code, the application fails to adequately sanitize or encode these characters within the Document Object Model context. Consequently, when the interface renders information about the pending upload, it inadvertently executes the embedded script in the victim's browser session rather than treating the content as inert text data.
The operational impact of this vulnerability is significant because it allows for a low-privileged attacker to execute arbitrary JavaScript code within the security context of the authenticated user. Since DOM-based XSS attacks are processed entirely on the client side, they do not require server-side storage of the malicious payload, making them difficult to detect via traditional web application firewalls that inspect only HTTP request and response bodies. An exploited vulnerability can lead to session hijacking through cookie theft, credential harvesting by redirecting users to phishing sites mimicking legitimate OutSystems interfaces, or defacement of the user interface. Furthermore, if the Service Center is integrated with other enterprise systems, an attacker could potentially use the compromised browser context to perform actions on behalf of the victim across trusted domains, escalating from a simple XSS incident to broader account compromise and lateral movement within the organization's infrastructure.
From a classification perspective, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. More specifically, it falls under CWE-80 due to its DOM-based nature where the script is executed via modifications to the DOM rather than through server-side injection into HTML output. In terms of offensive security frameworks such as MITRE ATT&CK, this technique corresponds to T1059.007 JavaScript Execution and potentially T1204.002 Malicious File for Initial Access if the file upload mechanism is used as a vector for initial compromise. The attack relies on social engineering or prior access to trick users into uploading specifically crafted files, leveraging the trust relationship between the user's browser and the application domain.
Mitigation strategies must focus on both immediate remediation and long-term defensive coding practices. As noted in the provided context, the primary resolution is upgrading OutSystems Service Center to version 11.41.2 or later, where the vendor has implemented proper input validation and output encoding mechanisms for file metadata displayed in the DOM. For organizations unable to patch immediately due to operational constraints, compensating controls should include implementing strict Content Security Policy headers that restrict script execution from unauthorized sources and disable inline scripts if feasible within their specific deployment model. Additionally, developers reviewing custom integrations or extensions using this API must ensure that any dynamic insertion of file names into the DOM utilizes context-appropriate encoding functions rather than direct string concatenation. Regular security training for users regarding suspicious file uploads can also reduce the likelihood of successful exploitation by preventing the initial upload action from occurring in a trusted session.