CVE-2026-72594 in lobe-chat
Zusammenfassung
von MITRE • 10.08.2026
A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar. The avatar upload handler derives the stored file extension and S3 content type from the original filename rather than inspecting file content, enabling an attacker to store an SVG containing a script element that executes in the browser of any user who views the attacker's profile or avatar.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.