CVE-2026-63148 in Agora Project
Summary
by MITRE • 10/15/2026
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_FILES. Attackers can submit a crafted filename that is stored and later rendered in components such as the dashboard controller (CtrlDashboard), executing arbitrary script in the browsers of users who view the affected page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The Omnispace Agora Project, specifically versions prior to 26.10.0, contains a critical security flaw classified as a stored cross-site scripting vulnerability. This defect arises from insufficient input validation and sanitization mechanisms within the application's file upload functionality. The core technical issue lies in how the system handles filenames associated with uploaded poll-response attachments. While the application employs a parameter filter to sanitize certain inputs via the $_FILES superglobal, this security control is effectively bypassed when processing attachment metadata such as filenames. Consequently, an attacker who has obtained valid authentication credentials can upload a file where the filename itself contains malicious HTML or JavaScript code rather than relying on traditional script injection in form fields or content bodies.
The operational impact of this vulnerability is significant due to its stored nature. Unlike reflected cross-site scripting attacks that require immediate user interaction with a crafted link, the payload embedded within the malicious filename persists on the server side after upload. When other users access specific areas of the application, such as the dashboard controller identified as CtrlDashboard, the system retrieves and renders this data without adequate encoding or escaping. This results in the execution of arbitrary scripts within the context of the victim's browser session. The attacker can leverage this capability to steal sensitive information including session cookies, perform actions on behalf of the user, redirect traffic to malicious sites, or deface the application interface. Because the payload is stored server-side, it affects every authenticated user who views the affected page until the malicious data is manually removed from the database or file system.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The specific mechanism involves stored XSS where untrusted data is saved by a web application and later displayed to other users without proper validation or encoding. In terms of the MITRE ATT&CK framework, this behavior corresponds to T1059 Command and Control Execution via Web Protocols if used for broader command and control activities, but more directly maps to T1189 Drive-by Compromise through malicious file uploads that lead to client-side code execution. The bypass of paramFilter highlights a failure in defense-in-depth strategies where multiple layers of input validation are not consistently applied across all data entry points including metadata fields like filenames.
To mitigate this vulnerability, immediate patching to version 26.10.0 or later is required as the vendor has addressed these sanitization gaps. In environments where upgrading is not immediately feasible, administrators should implement strict allow-lists for allowed file extensions and enforce rigorous content-type validation on uploads. Additionally, applying output encoding specifically targeting HTML entities when rendering filenames in views such as CtrlDashboard can prevent script execution even if malicious data persists in storage. Implementing a Content Security Policy with nonces or hashes further restricts the ability of injected scripts to execute. Regular security audits focusing on file upload handlers and metadata processing are essential to ensure that sanitization filters like paramFilter cover all input vectors including those derived from uploaded files rather than just direct form parameters.