Bug 2566165 (CVE-2026-121627)
| Summary: | CVE-2026-121627 buku: buku: Stored cross-site scripting via unescaped bookmark URL in bukuserver | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in buku. Improper sanitization of bookmark URLs in the bukuserver web interface leads to a stored cross-site scripting (XSS) vulnerability. A remote, unauthenticated attacker can submit a bookmark containing malicious code through the API endpoint. When an affected user views the bookmark list, the injected script executes in their browser, allowing the attacker to perform unauthorized actions using the victim's credentials.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-03 19:55:48 UTC
|