CVE-2026-90453 in Malcolm
要約
〜によって MITRE • 2026年09月12日
A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be redirected to an arbitrary external destination after completing an upload.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.