Bug 2548949 (CVE-2026-17025)
| Summary: | CVE-2026-17025 graphene: graphene: Stored Cross-Site Scripting via profile fields | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | ilpinto, ltomasbo, rhel-process-autobot, watson-tool-maintainers, ykashtan |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in graphene. Due to insufficient input sanitization and output escaping in user profile fields, an authenticated attacker with low-level privileges can conduct stored Cross-Site Scripting (XSS) attacks. By injecting malicious scripts into profile fields, an attacker can execute arbitrary script code in the browser of any user viewing the affected page, potentially compromising user sessions or exposing sensitive information.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2549516, 2549517, 2549525 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-10 05:41:53 UTC
|